CVE-2024-0410

An authorization bypass vulnerability was discovered in GitLab affecting versions 15.1 prior to 16.7.6, 16.8 prior to 16.8.3, and 16.9 prior to 16.9.1. A developer could bypass CODEOWNERS approvals by creating a merge conflict.

Scoring

Severity

HIGH

CVSS base score

7.7

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

EPSS probability

0.46%

CWE

CWE-841

Published

2024-02-21

Last modified

2026-08-14

Affected products

• GitLab GitLab
• GitLab GitLab
• GitLab GitLab

Weakness type

• CWE-841

Related vulnerabilities

• CVE-2026-87503 — Inappropriate implementation in Downloads in Google Chrome on on Android prior to 153.0.8010.36...
• CVE-2026-53637 — Sylius: Cart FormComponent allows modification or deletion of an already-completed order
• CVE-2026-67279 — SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS
• CVE-2026-82423 — macrozheng mall Payment Status Endpoint paySuccess behavioral workflow
• CVE-2026-55763 — Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splits
• CVE-2026-78103 — Dimension Log Server Configuration Lock Bypass Vulnerability
• CVE-2026-78618 — Dimension Business Logic Flaw Allows Chained Backend Object Operations
• CVE-2026-77508 — Weblate: Unverified REST API email changes

Markdown version · Browse all CVEs