CVE-2024-11669

What it actually does

Certain API endpoints apply token scopes too broadly, permitting tokens with limited permissions to retrieve sensitive data they should not access.

Why it matters to the business

Organizations face risk of unauthorized exposure of confidential information, potential compliance violations, and operational disruption while addressing the flaw.

How an attack unfolds

An attacker obtains an API token issued for a narrow purpose; the overly permissive scope enforcement on targeted endpoints allows the token to be reused to fetch data outside its intended authorization boundaries.

How to fix it

Upgrade GitLab CE/EE to version 17.4.5 or later, 17.5.3 or later, or 17.6.1 or later depending on the installed branch; review and tighten token scope assignments after patching.

How to confirm the fix worked

Confirm the running GitLab version matches a fixed release; attempt previously successful unauthorized requests with limited-scope tokens to verify they now return appropriate access-denied responses.

Typical attack path

1. Obtain a low-privilege API token through normal user or integration workflows
2. Identify affected API endpoints via documentation or testing
3. Submit requests to those endpoints using the limited-scope token
4. Receive sensitive data responses that should have been blocked by scope checks

How to detect it

Inspect API access logs for requests to sensitive endpoints that succeed with tokens whose documented scopes do not include those endpoints; correlate with authentication events showing limited-scope token issuance.

What your security team should do

• Apply the listed GitLab version upgrades immediately given the public disclosure
• Audit existing personal access tokens and OAuth applications for overly broad scopes
• Enable enhanced API logging and monitor for anomalous data access patterns
• Review downstream dependent services that integrate via GitLab APIs