Improper Access Control in GitLab (CVE-2024-5257)
GitLab CE/EE versions from 17.0 up to but not including 17.0.4 and from 17.1 up to but not including 17.1.2 contain an improper access control vulnerability. This flaw allows a Developer user assigned the custom role 'admin_compliance_framework' to potentially modify the URL for a group namespace. The issue has been addressed in versions 17.0.4 and 17.1.2.
AI Analysis
Technical Summary
CVE-2024-5257 is an improper access control vulnerability in GitLab Community and Enterprise Editions affecting versions >=17.0.0 <17.0.4 and >=17.1.0 <17.1.2. A Developer user with the 'admin_compliance_framework' custom role may have been able to modify the URL of a group namespace, which should be restricted. This could lead to unauthorized changes in group namespace URLs. The vulnerability has been patched in versions 17.0.4 and 17.1.2.
Potential Impact
The vulnerability allows a Developer user with a specific custom role to modify group namespace URLs, which could lead to unauthorized changes in GitLab group configurations. This may affect project organization and access control but does not indicate direct code execution or data exfiltration based on the provided information.
Mitigation Recommendations
A patch is available and should be applied by upgrading GitLab to version 17.0.4 or later for the 17.0 branch, and to version 17.1.2 or later for the 17.1 branch. Applying these official fixes will remediate the vulnerability.
Improper Access Control in GitLab (CVE-2024-5257)
Description
GitLab CE/EE versions from 17.0 up to but not including 17.0.4 and from 17.1 up to but not including 17.1.2 contain an improper access control vulnerability. This flaw allows a Developer user assigned the custom role 'admin_compliance_framework' to potentially modify the URL for a group namespace. The issue has been addressed in versions 17.0.4 and 17.1.2.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-5257 is an improper access control vulnerability in GitLab Community and Enterprise Editions affecting versions >=17.0.0 <17.0.4 and >=17.1.0 <17.1.2. A Developer user with the 'admin_compliance_framework' custom role may have been able to modify the URL of a group namespace, which should be restricted. This could lead to unauthorized changes in group namespace URLs. The vulnerability has been patched in versions 17.0.4 and 17.1.2.
Potential Impact
The vulnerability allows a Developer user with a specific custom role to modify group namespace URLs, which could lead to unauthorized changes in GitLab group configurations. This may affect project organization and access control but does not indicate direct code execution or data exfiltration based on the provided information.
Mitigation Recommendations
A patch is available and should be applied by upgrading GitLab to version 17.0.4 or later for the 17.0 branch, and to version 17.1.2 or later for the 17.1 branch. Applying these official fixes will remediate the vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-gitlab-2024-5257
- Osv Schema Version
- 1.5.0
- Aliases
- ["CVE-2024-5257"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Medium
Threat ID: 6aa329a391cc7f3848d1c535
Added to database: 09/10/2026, 22:05:23 UTC
Last enriched: 09/10/2026, 22:33:30 UTC
Last updated: 09/10/2026, 23:08:11 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.