GHSA-wf4m-rq68-3mfc

GHSA-wf4m-rq68-3mfc PUBLISHED CVSS 7.5 HIGH

Record from GitHub Advisory Database · Published January 12, 2023

Incorrect Authorization check affecting all versions of GitLab EE from 13.11 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2 allows group access tokens to continue working even after the group owner loses the ability to revoke them.

Risk scores

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Timeline

Jan 12, 2023 CVE Published
May 1, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-wf4m-rq68-3mfc
vulnetix vdb fixes GHSA-wf4m-rq68-3mfc

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-wf4m-rq68-3mfc/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

https://nvd.nist.gov/vuln/detail/CVE-2022-4167 advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4167.json url
https://gitlab.com/gitlab-org/gitlab/-/issues/367740 url

Look up in the Resolve Platform →