CVE-2024-0861: 
GitLab vulnerability analysis and mitigation

A vulnerability has been discovered in GitLab Enterprise Edition (EE) affecting versions 16.4 through 16.9.1 (before 16.7.6, 16.8.3, and 16.9.1). The vulnerability allows users with the 'Guest' role to modify 'Custom dashboard projects' settings contrary to intended permissions (GitLab Release, NVD).

The vulnerability is classified with a CVSS v3.1 Base Score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The issue stems from an authorization bypass that allows Guest users to access and modify analytics dashboard settings, which should be restricted based on their role permissions (GitLab Release).

When exploited, this vulnerability allows Guest users to change Custom dashboard projects settings for projects in the victim group, bypassing intended permission restrictions. This represents a violation of the principle of least privilege and could potentially impact project analytics configuration integrity (GitLab Issue).

The vulnerability has been patched in GitLab versions 16.7.6, 16.8.3, and 16.9.1. Organizations are strongly recommended to upgrade to one of these patched versions immediately to mitigate the risk (GitLab Release).