CVE-2024-0199: 
GitLab vulnerability analysis and mitigation

An authorization bypass vulnerability (CVE-2024-0199) was discovered in GitLab affecting versions 11.3 prior to 16.7.7, 16.7.6 prior to 16.8.4, and 16.8.3 prior to 16.9.2. The vulnerability allows attackers to bypass CODEOWNERS approval mechanisms by utilizing a crafted payload in an old feature branch (GitLab Security, Debian Tracker).

The vulnerability has been assigned a CVSS v3.1 score of 7.7 (High) with the following vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N. The issue stems from a flaw in the CODEOWNERS approval mechanism that could be exploited through manipulation of branch operations and merge requests (GitLab Security).

If exploited, this vulnerability allows attackers to bypass CODEOWNERS approval requirements, potentially enabling unauthorized code modifications and access to protected variables. This could lead to the exposure of sensitive information and unauthorized changes to protected branches (GitLab Security).

The vulnerability requires an attacker to have developer access to the repository and involves a specific sequence of actions including branch creation, merge request manipulation, and branch deletion to bypass the CODEOWNERS approval mechanism (GitLab Security).

GitLab has released security updates to address this vulnerability. Users are strongly recommended to upgrade to one of the following fixed versions: 16.7.7, 16.8.4, or 16.9.2. GitLab.com has already been updated with the patched version (GitLab Security).

The vulnerability was responsibly disclosed through GitLab's HackerOne bug bounty program by security researcher ali_shehab. GitLab has acknowledged and addressed the issue promptly through their security release process (GitLab Security).