CVE-2024-1299: GitLab Privilege Escalation Vulnerability

CVE-2024-1299 Overview

CVE-2024-1299 is a privilege escalation vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw affects GitLab versions 16.8 prior to 16.8.4 and 16.9 prior to 16.9.2. Users assigned a custom role containing the manage_group_access_tokens permission can rotate group access tokens that carry owner privileges. This allows a lower-privileged actor to obtain a valid token with elevated group ownership rights. The issue is tracked under [CWE-268] (Privilege Chaining) and was addressed in the GitLab 16.9.2 security release.

Critical Impact
A user holding only the manage_group_access_tokens custom permission can rotate group access tokens with owner-level privileges, effectively escalating their access to full group ownership.

Affected Products

GitLab Community Edition 16.8 through 16.8.3
GitLab Enterprise Edition 16.8 through 16.8.3
GitLab Community Edition and Enterprise Edition 16.9 through 16.9.1

Discovery Timeline

2024-03-06 - GitLab publishes security release 16.9.2 addressing the vulnerability
2024-03-07 - CVE-2024-1299 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1299

Vulnerability Analysis

GitLab supports custom roles that grant granular permissions to users without assigning them a full Owner or Maintainer role. The manage_group_access_tokens permission is intended to let a delegated user administer group access tokens without granting broader ownership rights. GitLab's token rotation endpoint failed to enforce a privilege boundary check when the target token belonged to a user or bot account with owner-level scope. As a result, a user holding only the custom permission could invoke the rotation flow against an owner-tier token and receive a newly issued token inheriting those owner privileges. The vulnerability is classified as improper privilege management ([CWE-268]) because the permission granted for one action was used to perform a functionally different, higher-privileged action.

Root Cause

The root cause is missing authorization validation in the group access token rotation logic. The code path verified that the caller held manage_group_access_tokens but did not verify that the caller's effective role met or exceeded the privilege level of the token being rotated. Rotation therefore acted as an implicit privilege delegation from Owner-scoped tokens to any custom-role holder able to trigger the operation.

Attack Vector

Exploitation requires network access to a GitLab instance and an authenticated account assigned a custom role that includes manage_group_access_tokens. The attacker identifies an existing group access token created with Owner privileges and issues a rotation request against it through the GitLab API or web UI. The API returns a new token that preserves the Owner scope of the original. The attacker then authenticates using the rotated token to perform Owner-level actions on the group, including modifying members, secrets, protected branches, and CI/CD variables. No user interaction is required beyond the attacker's own authenticated session.

Technical detail on the fix and reproduction path is available in the GitLab Security Release Announcement, the GitLab issue tracker, and the HackerOne disclosure report.

Detection Methods for CVE-2024-1299

Indicators of Compromise

Group access token rotation events initiated by users who do not hold Owner or Maintainer roles on the target group.
Newly issued group access tokens whose scope or role attribute exceeds the rotating user's assigned base role.
Sudden Owner-level API activity originating from a token that was recently rotated by a custom-role user.

Detection Strategies

Review GitLab audit events for group_access_token_rotated actions and correlate the actor's effective role against the token's role at rotation time.
Query the GitLab admin API to enumerate all group access tokens, their access_level, and their most recent rotation timestamp against the 16.8 and 16.9 exposure window.
Alert when any user holding a custom role interacts with the /groups/:id/access_tokens/:token_id/rotate endpoint.

Monitoring Recommendations

Forward GitLab audit and API logs to a centralized analytics platform and retain them for the exposure window prior to patching.
Track creation and rotation of Owner-scoped group access tokens as a high-signal event class.
Baseline expected token rotation patterns per group and flag deviations, particularly rotations performed by non-Owner accounts.

How to Mitigate CVE-2024-1299

Immediate Actions Required

Upgrade all self-managed GitLab instances to 16.9.2, 16.8.4, or later as documented in the GitLab security release notes.
Audit every custom role definition and remove manage_group_access_tokens from roles held by users who should not exercise Owner-level control.
Revoke and reissue all group access tokens that existed on affected versions, prioritizing Owner-scoped tokens.

Patch Information

GitLab addressed CVE-2024-1299 in versions 16.9.2 and 16.8.4, released on 2024-03-06. Both Community Edition and Enterprise Edition builds include the fix. GitLab.com SaaS instances were patched by GitLab prior to public disclosure. Full release details are available in the GitLab 16.9.2 Security Release Announcement.

Workarounds

Remove the manage_group_access_tokens permission from all custom roles until the instance is patched.
Restrict creation of Owner-scoped group access tokens to a small set of trusted maintainers and rotate them manually.
Enforce short expiration windows on group access tokens so that any inherited privileges from an unauthorized rotation are time-bounded.

bash

# Example: list group access tokens for review via the GitLab API
curl --header "PRIVATE-TOKEN: <admin_token>" \
  "https://gitlab.example.com/api/v4/groups/<group_id>/access_tokens"

# Revoke a specific group access token after audit
curl --request DELETE \
  --header "PRIVATE-TOKEN: <admin_token>" \
  "https://gitlab.example.com/api/v4/groups/<group_id>/access_tokens/<token_id>"