CVE-2023-6564

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab EE Premium and Ultimate affecting versions 16.4.3, 16.5.3, and 16.6.1. In projects using subgroups to define who can push and/or merge to protected branches, there may have been instances in which subgroup members with the Developer role were able to push or merge to protected branches.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Feb 8, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-65655.9The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.12.3 via CVE-2023-65666.5Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.CVE-2023-65677.5The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and includCVE-2023-65686.1A reflected Cross-Site Scripting (XSS) vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the ContentCVE-2023-65698.2External Control of File Name or Path in h2oai/h2o-3CVE-2023-65706.5Server-Side Request Forgery (SSRF) in kubeflow/kubeflowCVE-2023-65716.1Cross-site Scripting (XSS) - Reflected in kubeflow/kubeflowCVE-2023-65728.1Command Injection in GitHub repository gradio-app/gradio prior to main.CVE-2023-65735.5HPE OneView may have a missing passphrase during restore.CVE-2023-65748.8A vulnerability was found in Byzoro Smart S20 up to 20231120 and classified as critical. Affected by this issue is some unknown functionalitCVE-2023-65758.8A vulnerability was found in Byzoro S210 up to 20231121. It has been classified as critical. This affects an unknown part of the file /Tool/CVE-2023-65768.8A vulnerability was found in Byzoro S210 up to 20231123. It has been declared as critical. This vulnerability affects unknown code of the fi