title: Improper Access Control in GitLab
description: An issue has been discovered in GitLab EE affecting all versions starting from 15.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Code owner approval was not removed from merge requests when the target branch was updated.
problem types: CWE-284: Improper Access Control
affected:
{
vendor: GitLab
product: GitLab
repo: git://git@gitlab.com:gitlab-org/gitlab.git
versions:
version: 15.3, status: affected, lessThan: 16.2.8, versionType: semver
version: 16.3, status: affected, lessThan: 16.3.5, versionType: semver
version: 16.4, status: affected, lessThan: 16.4.1, versionType: semver
defaultStatus: unaffected
}
metrics:
format: CVSS
scenarios: GENERAL
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 8.1
baseSeverity: HIGH
]
solutions: Upgrade to version 16.2.8, 16.3.5, 16.4.1 or above