Improper Access Control in GitLab (CVE-2024-5430)
GitLab CE/EE versions from 16.10 up to but excluding 16.11.5, from 17.0 up to but excluding 17.0.3, and from 17.1 up to but excluding 17.1.1 contain an improper access control vulnerability. This flaw allows a project maintainer to delete the merge request approval policy via GraphQL, which should be restricted. The issue has been addressed in the specified fixed versions.
AI Analysis
Technical Summary
CVE-2024-5430 is an improper access control vulnerability in GitLab CE/EE affecting versions >=16.10.0 <16.11.5, >=17.0.0 <17.0.3, and >=17.1.0 <17.1.1. The vulnerability allows a project maintainer to delete the merge request approval policy through the GraphQL interface, potentially bypassing intended restrictions on approval policies. This issue has been fixed in versions 16.11.5, 17.0.3, and 17.1.1.
Potential Impact
A project maintainer can delete merge request approval policies, which may weaken the intended approval workflow controls within GitLab projects. This could lead to unauthorized changes being merged without the required approvals, impacting project governance and code integrity. There is no indication of active exploitation in the wild.
Mitigation Recommendations
Upgrade GitLab CE/EE to versions 16.11.5, 17.0.3, or 17.1.1 or later where this vulnerability has been fixed. Since a patch is available, applying the official fix is the recommended remediation.
Improper Access Control in GitLab (CVE-2024-5430)
Description
GitLab CE/EE versions from 16.10 up to but excluding 16.11.5, from 17.0 up to but excluding 17.0.3, and from 17.1 up to but excluding 17.1.1 contain an improper access control vulnerability. This flaw allows a project maintainer to delete the merge request approval policy via GraphQL, which should be restricted. The issue has been addressed in the specified fixed versions.
Affected software
pkg:bitnami/gitlabRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-5430 is an improper access control vulnerability in GitLab CE/EE affecting versions >=16.10.0 <16.11.5, >=17.0.0 <17.0.3, and >=17.1.0 <17.1.1. The vulnerability allows a project maintainer to delete the merge request approval policy through the GraphQL interface, potentially bypassing intended restrictions on approval policies. This issue has been fixed in versions 16.11.5, 17.0.3, and 17.1.1.
Potential Impact
A project maintainer can delete merge request approval policies, which may weaken the intended approval workflow controls within GitLab projects. This could lead to unauthorized changes being merged without the required approvals, impacting project governance and code integrity. There is no indication of active exploitation in the wild.
Mitigation Recommendations
Upgrade GitLab CE/EE to versions 16.11.5, 17.0.3, or 17.1.1 or later where this vulnerability has been fixed. Since a patch is available, applying the official fix is the recommended remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-gitlab-2024-5430
- Osv Schema Version
- 1.5.0
- Aliases
- ["CVE-2024-5430"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Medium
Threat ID: 6aa329a391cc7f3848d1c532
Added to database: 09/10/2026, 22:05:23 UTC
Last enriched: 09/10/2026, 22:33:06 UTC
Last updated: 09/10/2026, 22:33:06 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.