CVE-2024-0410: GitLab Authorization Bypass Vulnerability

CVE-2024-0410 Overview

CVE-2024-0410 is an authorization bypass vulnerability in GitLab. A developer with existing project access can bypass CODEOWNERS approval requirements by intentionally creating a merge conflict on a merge request. The flaw affects GitLab versions 15.1 through 16.7.5, 16.8 prior to 16.8.3, and 16.9 prior to 16.9.1. This weakness undermines protected branch policies that rely on CODEOWNERS for review enforcement, enabling unauthorized code changes to reach protected branches. The issue is tracked under CWE-841: Improper Enforcement of Behavioral Workflow.

Critical Impact
A low-privileged developer can merge code into protected branches without required CODEOWNERS approval, breaking source-code integrity and change-review controls.

Affected Products

GitLab Community Edition (CE) 15.1 through 16.7.5
GitLab Enterprise Edition (EE) 16.8 prior to 16.8.3
GitLab CE/EE 16.9 prior to 16.9.1

Discovery Timeline

2024-02-22 - CVE-2024-0410 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0410

Vulnerability Analysis

GitLab's CODEOWNERS feature enforces mandatory reviewer approval for changes to specified files or paths on protected branches. The merge request approval logic evaluates the diff against CODEOWNERS rules to determine which owners must approve before merge. This vulnerability breaks that guarantee: when a merge conflict exists, GitLab fails to correctly re-evaluate the approval requirements for the resulting changes. A developer with permission to push branches and open merge requests can exploit this gap to merge code that would otherwise require code-owner sign-off. The result is an integrity impact on protected branches without needing to escalate privileges or compromise a code-owner account.

Root Cause

The root cause is improper enforcement of the merge-request approval workflow ([CWE-841]) during conflict resolution. GitLab's approval state machine did not consistently reapply CODEOWNERS approval requirements to the post-conflict-resolution state of the merge request. The conflicted merge path effectively bypassed the branch protection check that normally blocks merges lacking code-owner approval.

Attack Vector

Exploitation requires an authenticated developer account with permission to open merge requests against a protected branch. The attacker crafts a merge request that produces a conflict with the target branch, then leverages the conflict-resolution flow to merge changes without triggering the mandatory CODEOWNERS approval gate. The attack is network-reachable through the standard GitLab web UI or API and requires user interaction from a merger. Technical details are described in GitLab Issue #437988 and HackerOne Report #2296778.

Detection Methods for CVE-2024-0410

Indicators of Compromise

Merges to protected branches whose commit history shows conflict-resolution commits but lacks approvals from users defined in the repository CODEOWNERS file.
Merge request events where merge_status transitioned through a conflict state immediately before completion without a matching approval_added event from a code owner.
Unexpected changes to files or paths listed in CODEOWNERS on protected branches such as main, master, or release/*.

Detection Strategies

Audit GitLab audit-event streams and webhook payloads for merge_request events, correlating merged actions with the presence of required CODEOWNERS approvers.
Run repository-level scripts that compare merged commits against CODEOWNERS rules and flag merges lacking required approver signatures.
Compare current GitLab server version against the fixed releases (16.7.6, 16.8.3, 16.9.1) and treat any earlier 15.1+ instance as vulnerable.

Monitoring Recommendations

Forward GitLab audit logs and merge-request webhooks to a centralized SIEM or data lake for continuous review of protected-branch activity.
Alert on merge requests that are merged within a short window of resolving conflicts on protected branches.
Review CODEOWNERS policy effectiveness weekly by sampling recent merges and confirming approver identities against ownership rules.

How to Mitigate CVE-2024-0410

Immediate Actions Required

Upgrade GitLab to version 16.7.6, 16.8.3, 16.9.1, or later depending on your release track.
Inventory self-managed GitLab instances and prioritize patching internet-exposed servers first.
Review merge activity on protected branches since GitLab 15.1 was deployed and validate that CODEOWNERS approvals were obtained for sensitive changes.

Patch Information

GitLab addressed CVE-2024-0410 in versions 16.7.6, 16.8.3, and 16.9.1. GitLab.com SaaS customers received the fix automatically. Self-managed administrators should apply the corresponding patch release for their major version. Refer to GitLab Issue #437988 for the official tracking record.

Workarounds

Restrict merge permissions on protected branches to maintainers or owners until the patch is applied, reducing the pool of accounts able to trigger the bypass.
Require multiple approvals from named reviewers in addition to CODEOWNERS, so approval enforcement does not depend solely on the affected code-owner check.
Temporarily block direct merges from branches with unresolved conflicts and require rebased, conflict-free merge requests for protected branches.

bash

# Verify the running GitLab version on a self-managed instance
sudo gitlab-rake gitlab:env:info | grep 'GitLab information' -A 5

# Example: upgrade an Omnibus GitLab package on Debian/Ubuntu to a fixed release
sudo apt-get update
sudo apt-get install gitlab-ee=16.9.1-ee.0

# Confirm the upgrade succeeded and services are healthy
sudo gitlab-ctl reconfigure
sudo gitlab-ctl status