CVE-2017-0926

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the Oauth sign-in component resulting in unauthorized user login.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-285 CWE-863

Affected software

Vendor	Product	Versions
GitLab	GitLab Community and Enterprise Editions	9.1.0 - 10.0.5 Fixed in 10.0.5; 10.1.0 - 10.1.5 Fixed in 10.1.6; 10.2.0 - 10.2.5 Fixed in 10.2.6; 10.3.0 - 10.3.3 Fixed in 10.3.4

References

https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/32198Exploit, Issue Tracking
https://www.debian.org/security/2018/dsa-4145Third Party Advisory
https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/32198Exploit, Issue Tracking
https://www.debian.org/security/2018/dsa-4145Third Party Advisory

Timeline

Published: Mar 21, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-09276.5Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the deployment keys component resulting in unautho CVE-2017-09286.1html-janitor node module suffers from an External Control of Critical State Data vulnerability via user-control of the '_sanitized' variable CVE-2017-09297.5DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class. Attackers ma CVE-2017-09306.5augustine node module suffers from a Path Traversal vulnerability due to lack of validation of url, which allows a malicious user to read co CVE-2017-09316.1html-janitor node module suffers from a Cross-Site Scripting (XSS) vulnerability via clean() accepting user-controlled values.CVE-2017-09328.8Ubiquiti Networks EdgeOS version 1.9.1.1 and prior suffer from an Improper Privilege Management vulnerability due to the lack of validation CVE-2017-09338.0Ubiquiti Networks EdgeOS version 1.9.1 and prior suffer from a Cross-Site Request Forgery (CSRF) vulnerability. An attacker with access to a CVE-2017-09348.8Ubiquiti Networks EdgeOS version 1.9.1 and prior suffer from an Improper Privilege Management vulnerability due to the lack of protection of CVE-2017-09358.8Ubiquiti Networks EdgeOS version 1.9.1.1 and prior suffer from an Improper Privilege Management vulnerability due to the lack of protection CVE-2017-09365.7Nextcloud Server before 11.0.7 and 12.0.5 suffers from an Authorization Bypass Through User-Controlled Key vulnerability. A missing ownershi CVE-2017-09387.5Denial of Service attack in airMAX < 8.3.2 , airMAX < 6.0.7 and EdgeMAX < 1.9.7 allow attackers to use the Discovery Protocol in amplificati CVE-2017-100007.7Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Hospitality Applications (subcomponent: Reporting). Supp