{"id":"CVE-2017-11438","details":"GitLab Community Edition (CE) and Enterprise Edition (EE) before 9.0.11, 9.1.8, 9.2.8 allow an authenticated user with the ability to create a group to add themselves to any project that is inside a subgroup.","modified":"2026-08-27T18:52:41.335132Z","published":"2017-08-02T19:29:00.837Z","references":[{"type":"ADVISORY","url":"https://about.gitlab.com/2017/07/19/gitlab-9-dot-3-dot-8-released/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://gitlab.com/gitlab-org/gitlab","events":[{"introduced":"f33774cb120324d428dabf52c89b8a65e4d4c166"},{"last_affected":"61fee1520adef668450ae7315423542065d05028"}],"database_specific":{"cpe":["cpe:2.3:a:gitlab:gitlab:9.0.0:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.0:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.1:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.1:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.2:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.2:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.3:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.3:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.4:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.4:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.5:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.5:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.6:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.6:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.7:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.7:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.8:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.8:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.9:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.9:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.10:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.10:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.1.0:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.1.0:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.1.1:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.1.1:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.1.2:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.1.2:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.1.3:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.1.3:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.1.4:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.1.4:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.1.5:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.1.5:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.1.6:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.1.6:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.1.7:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.1.7:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.2.0:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.2.0:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.2.1:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.2.1:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.2.2:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.2.2:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.2.3:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.2.3:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.2.4:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.2.4:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.2.5:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.2.5:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.2.6:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.2.6:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.2.7:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.2.7:*:*:*:enterprise:*:*:*"],"extracted_events":[{"introduced":"9.0.0"},{"last_affected":"9.0.0"},{"introduced":"9.0.1"},{"last_affected":"9.0.1"},{"introduced":"9.0.2"},{"last_affected":"9.0.2"},{"introduced":"9.0.3"},{"last_affected":"9.0.3"},{"introduced":"9.0.4"},{"last_affected":"9.0.4"},{"introduced":"9.0.5"},{"last_affected":"9.0.5"},{"introduced":"9.0.6"},{"last_affected":"9.0.6"},{"introduced":"9.0.7"},{"last_affected":"9.0.7"},{"introduced":"9.0.8"},{"last_affected":"9.0.8"},{"introduced":"9.0.9"},{"last_affected":"9.0.9"},{"introduced":"9.0.10"},{"last_affected":"9.0.10"},{"introduced":"9.1.0"},{"last_affected":"9.1.0"},{"introduced":"9.1.1"},{"last_affected":"9.1.1"},{"introduced":"9.1.2"},{"last_affected":"9.1.2"},{"introduced":"9.1.3"},{"last_affected":"9.1.3"},{"introduced":"9.1.4"},{"last_affected":"9.1.4"},{"introduced":"9.1.5"},{"last_affected":"9.1.5"},{"introduced":"9.1.6"},{"last_affected":"9.1.6"},{"introduced":"9.1.7"},{"last_affected":"9.1.7"},{"introduced":"9.2.0"},{"last_affected":"9.2.0"},{"introduced":"9.2.1"},{"last_affected":"9.2.1"},{"introduced":"9.2.2"},{"last_affected":"9.2.2"},{"introduced":"9.2.3"},{"last_affected":"9.2.3"},{"introduced":"9.2.4"},{"last_affected":"9.2.4"},{"introduced":"9.2.5"},{"last_affected":"9.2.5"},{"introduced":"9.2.6"},{"last_affected":"9.2.6"},{"introduced":"9.2.7"},{"last_affected":"9.2.7"}],"source":"CPE_STRING"}}],"versions":["9.0.0","9.0.1","9.0.10","9.0.2","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9","9.1.0","9.1.1","9.1.2","9.1.3","9.1.4","9.1.5","9.1.6","9.1.7","9.2.0","9.2.1","9.2.2","9.2.3","9.2.4","9.2.5","9.2.6","9.2.7"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-11438.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"}]}