ANCHORE-2023-5612

ANCHORE-2023-5612 PUBLISHED

An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the user email address via tags feed although the visibility in the user profile has been disabled.

Affected Products

Vendor	Product	Versions
GitLab	GitLab Enterprise	0, 16.7, 16.8
GitLab	GitLab	16.7, 16.8, 0

Timeline

Jan 25, 2024 CVE Published
Jun 6, 2025 PoC Published

References

https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/ url
https://gitlab.com/gitlab-org/gitlab/-/issues/428441 url
https://hackerone.com/reports/2208790 url

Open in Interactive Console →