CVE-2014-8540

6.5 mediumEPSS 2.2%

Medium (6.5) in gitlab gitlab. EPSS 2.2% chance of exploitation in the next 30 days.

The groups API in GitLab 6.x and 7.x before 7.4.3 allows remote authenticated guest users to modify ownership of arbitrary groups by leveraging improper permission checks.

Severity

CVSS 3.0

6.5 medium

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS: 2.2% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-10-31)
CWE: CWE-264
Published: 2018-01-05
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

gitlab:gitlab

References

http://www.openwall.com/lists/oss-security/2014/10/31/2
http://www.securityfocus.com/bid/70841
https://about.gitlab.com/2014/10/30/gitlab-7-4-3-released/
https://exchange.xforce.ibmcloud.com/vulnerabilities/98449
https://gitlab.com/gitlab-org/gitlab-ce/commit/a2dfff418bf2532ebb5aee88414107929b17eefd

Check your stack JSON