CVE-2023-3441 is a medium severity (CVSS 6.6) GitLab issue: the product did not sufficiently warn about the security implications of granting merge rights to protected branches. It affects GitLab CE and EE from 8.0 before 16.4. Upgrade to 16.4 or later and review who can merge.
What's affected
The NVD record says all GitLab EE and CE versions starting from 8.0 and before 16.4 are affected. The fix, per the record range, arrived with version 16.4. The references in the record are GitLab issue tracker entries and HackerOne reports, which are not a substitute for the release notes.
This is an unusual entry. It is not a memory bug or an injection flaw. The product let administrators grant merge rights on protected branches without making clear what that permission allows, and the fix is about clearer warnings.
The score is medium. Check your own version, then read the GitLab 16.4 release notes for the exact change.
How to check if you're exposed
Find your GitLab version in the Admin Area dashboard, on the Help page when signed in, or from the command line on an Omnibus install.
sudo gitlab-rake gitlab:env:info
Then look at your branch protection settings. In each important project, open Settings, then Repository, then Protected branches, and review the Allowed to merge and Allowed to push columns.
Pay attention to roles and groups that were granted merge rights some time ago. Access granted for a one time need often stays in place for years.
What to do now
- Upgrade GitLab to 16.4 or a later supported release.
- Review protected branch settings on your default and release branches in every project.
- Remove merge and push rights that are not needed, and prefer a small named group over broad roles.
- Require approvals through merge request rules so one account cannot change protected code alone.
- Add a periodic access review for protected branches to your security calendar.
Why it matters
The record maps this to CWE-213 and describes it as a missing warning about a security relevant action. The permission itself worked as designed. The risk was that someone could grant it without understanding that it lets the grantee change code that ships to production.
Merge rights on a protected branch are effectively write access to your release path. Even a warning level issue is worth fixing, because software supply chain incidents often start with an over broad permission that nobody questioned. The record does not claim exploitation, and the CVE is not in the CISA KEV catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is this a code execution bug?
No. The record describes missing warnings about the implications of granting merge rights, not a memory or injection flaw. The remedy is upgrading and tightening permissions.
Sources
Last reviewed: 19 October 2026.
