CVE-2024-0456: 
GitLab vulnerability analysis and mitigation

CVE-2024-0456 is an authorization vulnerability discovered in GitLab affecting versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. The vulnerability was disclosed on January 25, 2024, and allows unauthorized attackers to assign arbitrary users to merge requests (MRs) that they created within a project (GitLab Advisory).

The vulnerability stems from an authorization bypass in the merge request functionality where users without project membership could manipulate assignee settings through API calls. The issue has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The vulnerability is classified under CWE-425 (Direct Request) (NVD).

The vulnerability allows unauthorized attackers to assign any user as an assignee to merge requests they created, even without having project membership. This could potentially be used to disrupt project workflows and cause confusion in project management (GitLab Issue).

Users are strongly advised to upgrade to GitLab versions 16.6.6, 16.7.4, or 16.8.1 or later, depending on their current version track. GitLab has patched this vulnerability in these releases (GitLab Advisory).