CVE-2023-5009

9.8 criticalEPSS 9.7%

Critical (9.8) in gitlab gitlab. EPSS 9.7% chance of exploitation in the next 30 days.

An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.2.7, all versions starting from 16.3 before 16.3.4. It was possible for an attacker to run pipeline jobs as an arbitrary user via scheduled security scan policies. This was a bypass of [CVE-2023-3932](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3932) showing additional impact.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 9.7% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-31)
CWE: CWE-863
Published: 2023-09-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

gitlab:gitlab

References

https://gitlab.com/gitlab-org/gitlab/-/issues/425304
https://hackerone.com/reports/2147126
https://gitlab.com/gitlab-org/gitlab/-/issues/425304
https://hackerone.com/reports/2147126

Check your stack JSON