CVE-2019-7155

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. A user retains their role within a project in a private group after being removed from the group, if their privileges within the project are different from the group.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/42726Exploit, Issue Tracking, Vendor Advisory
https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/42726Exploit, Issue Tracking, Vendor Advisory

Timeline

Published: Apr 16, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-71566.5In libdoc through 2019-01-28, calcFileBlockOffset in ole.c allows division by zero.CVE-2019-71589.8OX App Suite 7.10.0 and earlier has Incorrect Access Control.CVE-2019-71597.5OX App Suite 7.10.1 and earlier allows Information Exposure.CVE-2019-71609.8idreamsoft iCMS 7.0.13 allows admincp.php?app=files ../ Directory Traversal via the udir parameter to files.admincp.php, resulting in execut CVE-2019-71617.5An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. It uses fixed ciphering keys to protect information,CVE-2019-71629.1An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.6 Build 5607. An exposed service allows an unauthenticated person to retri CVE-2019-71639.8The web interface of Alcatel LINKZONE MW40-V-V1.0 MW40_LU_02.00_02 devices is vulnerable to an authentication bypass that allows an unauthen CVE-2019-71649.8SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.CVE-2019-71659.8A buffer overflow in DOSBox 0.74-2 allows attackers to execute arbitrary code.CVE-2019-71677.5Zcash, before the Sapling network upgrade (2018-10-28), had a counterfeiting vulnerability. A key-generation process, during evaluation of p CVE-2019-71684.8A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Blog field to /ad CVE-2019-71694.8A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /a