Description
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. When a user is created via the SAML provider, the external groups setting overrides the external provider configuration. As a result, the user may not be marked as external thereby giving those users access to internal projects or groups.
Metrics
CVSS 3.1 5.4/10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| GitLab | GitLab | >= 16.4, < 17.5.5; >= 17.6, < 17.6.3; >= 17.7, < 17.7.1 |
References
- https://about.gitlab.com/releases/2025/01/08/patch-release-gitlab-17-7-1-released/#instance-saml-does-not-respect-external_provider-configurationRelease Notes, Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/479165Exploit, Issue Tracking
Timeline
- Published
- Jan 9, 2025
- Last modified
- Jun 17, 2026
- NVD status
- Analyzed