Security readout for executives and security teams
Plain-English summary
CVE-2023-2190 could let a GitLab user see new commits to a private project through a fork that was created when the project was public. The business risk is unintended disclosure of source code or sensitive changes, not system takeover. Exposure depends on specific GitLab versions and project visibility history.
Executive priority
Handle as a moderate-priority confidentiality issue. It is not described as remote code execution, but it may expose proprietary source code or sensitive commits. Prioritize GitLab upgrades and repository exposure review where private projects were once public.
Technical view
GitLab CE/EE has a CWE-639 authorization bypass affecting 13.10 before 15.11.10, 16.0 before 16.0.6, and 16.1 before 16.1.1. CVSS 3.1 is 6.5, with network access, low privileges, no user interaction, and high confidentiality impact. Integrity and availability impacts are not reported.
Likely exposure
Most likely exposed are self-managed GitLab CE/EE instances in the affected version ranges with private projects that were previously public and had forks created during the public period. Organizations using GitLab for proprietary code should prioritize inventorying those projects.
Exploitation context
The provided sources include a GitLab issue and HackerOne report, but the source bundle does not show CISA KEV listing or confirmed active exploitation. Exploitation requires an authenticated user and a qualifying fork/private-project history, limiting reach but making insider or partner access scenarios relevant.
Researcher notes
This is an object-level authorization issue mapped to CWE-639. Focus analysis on authorization checks around forks, project visibility transitions, and commit visibility after a source project becomes private. The source bundle does not provide evidence of in-the-wild exploitation.
Mitigation direction
- Upgrade GitLab to 15.11.10, 16.0.6, 16.1.1, or later supported versions.
- Review vendor guidance in the linked GitLab issue and CVE record.
- Identify projects that changed from public to private and had forks while public.
- Restrict access for untrusted users until affected projects and forks are reviewed.
- Treat sensitive commits after visibility changes as potentially exposed until validated.
Validation and detection
- Confirm GitLab CE/EE version across all self-managed instances.
- List private projects that were previously public during affected version use.
- Review forks created while those projects were public.
- Check whether new private commits were visible through historical forks.
- Document findings and remediation status for affected repositories.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-639: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2023-2190 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N2.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- GitLab Issue #408137CVE reference · issue-tracking
- HackerOne Bug Bounty Report #1944500CVE reference · technical-description, exploit
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.