CVE-2024-7296

LowCVSS 2.7/10Last modified Jun 17, 2026

Description

An issue was discovered in GitLab EE affecting all versions from 16.5 prior to 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2 which allowed a user with a custom permission to approve pending membership requests beyond the maximum number of allowed users.

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 16.5, < 17.7.7; >= 17.8, < 17.8.5; >= 17.9, < 17.9.2

References

https://gitlab.com/gitlab-org/gitlab/-/issues/475056Exploit, Issue Tracking
https://hackerone.com/reports/2602274Permissions Required

Timeline

Published: Mar 13, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-72978.8Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged attacker to gain su CVE-2024-72995.4** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Bolt CMS 3.7.1. It has been rated as problematic. This issue affects some unkno CVE-2024-73005.4A vulnerability classified as problematic has been found in Bolt CMS 3.7.1. Affected is an unknown function of the file /bolt/editcontent/sh CVE-2024-73016.1The WordPress File Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and CVE-2024-73025.4The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 3gp2 file uploads CVE-2024-73035.4A vulnerability was found in itsourcecode Online Blood Bank Management System 1.0. It has been rated as problematic. This issue affects some CVE-2024-73045.4The Ninja Tables – Easiest Data Table Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all CVE-2024-73057.8A maliciously crafted DWF file, when parsed in AdDwfPdk.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A mali CVE-2024-73068.8A vulnerability, which was classified as critical, was found in SourceCodester Establishment Billing Management System 1.0. Affected is an u CVE-2024-73078.8A vulnerability has been found in SourceCodester Establishment Billing Management System 1.0 and classified as critical. Affected by this vu CVE-2024-73088.8A vulnerability was found in SourceCodester Establishment Billing Management System 1.0 and classified as critical. Affected by this issue i CVE-2024-73095.4A vulnerability was found in SourceCodester Record Management System 1.0. It has been classified as problematic. This affects an unknown par