---
id: CVE-2023-3932
title: Incorrect User Management in GitLab
summary: >-
  An issue has been discovered in GitLab EE affecting all versions starting from
  13.12 before 16.0.8, all versions starting from 16.1 before 16.1.3, all
  versions starting from 16.2 before 16.2.2. It was possible for an attacker to
  run pipe…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-286
vendor: GitLab
product: GitLab
affected:
  - GitLab >= 13.12 < 16.0.8
  - GitLab >= 16.1.0 < 16.1.3
  - GitLab >= 16.2.0 < 16.2.2
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2024-07-24T13:25:44.895120Z'
exploitAvailable: true
published: '2023-08-03'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T11:39:49.756Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-3932'
references:
  - url: 'https://gitlab.com/gitlab-org/gitlab/-/issues/417594'
    label: 'GitLab Issue #417594'
  - url: 'https://hackerone.com/reports/2057633'
    label: 'HackerOne Bug Bounty Report #2057633'
tags:
  - cve.org
  - exploit-available
epss: 0.00877
epssPercentile: 0.58823
ingestedAt: '2026-10-28T12:10:35.152Z'
---

## Overview

An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to run pipeline jobs as an arbitrary user via scheduled security scan policies.

## Affected

- `GitLab >= 13.12 < 16.0.8`
- `GitLab >= 16.1.0 < 16.1.3`
- `GitLab >= 16.2.0 < 16.2.2`

## Remediation

Upgrade to versions 16.2.2, 16.1.3, 16.0.8 or above.