CVE-2023-0805

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab EE affecting all versions starting from 15.2 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. A malicious group member may continue to have access to the public projects of a public group even after being banned from the public group by the owner.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
GitLab	GitLab	>=15.2, <15.9.6; >=15.10, <15.10.5; >=15.11, <15.11.1

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0805.jsonThird Party Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/391433Broken Link
https://hackerone.com/reports/1850046Permissions Required
https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0805.jsonThird Party Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/391433Broken Link
https://hackerone.com/reports/1850046Permissions Required

Timeline

Published: May 3, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-08086.8A vulnerability was found in Deye/Revolt/Bosswerk Inverter MW3_15U_5406_1.47/MW3_15U_5406_1.471. It has been rated as problematic. This issu CVE-2023-08095.3In Mosquitto before 2.0.16, excessive memory is allocated based on malicious initial packets that are not CONNECT packets.CVE-2023-08105.4Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.11.CVE-2023-08119.1Omron CJ1M unit v4.0 and prior has improper access controls on the memory region where the UM password is stored. If an adversary issues a P CVE-2023-08127.5The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.1 does not have proper authorization or nonce values for som CVE-2023-08137.5A flaw was found in the Network Observability plugin for OpenShift console. Unless the Loki authToken configuration is set to FORWARD mode, CVE-2023-08146.5The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to sensitive information disclosure via the CVE-2023-08156.5Potential Insertion of Sensitive Information into Jetty Log Files in multiple versions of OpenNMS Meridian and Horizon could allow disclosur CVE-2023-08166.5The Formidable Forms WordPress plugin before 6.1 uses several potentially untrusted headers to determine the IP address of the client, leadi CVE-2023-08177.8Buffer Over-read in GitHub repository gpac/gpac prior to v2.3.0-DEV.CVE-2023-08185.5Off-by-one Error in GitHub repository gpac/gpac prior to v2.3.0-DEV.CVE-2023-08197.8Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to v2.3.0-DEV.