CVE-2024-0199 is a high severity (CVSS 7.7) authorization bypass in GitLab. An attacker could get around CODEOWNERS approval by using a crafted payload in an old feature branch. GitLab fixed it in 16.9.2, 16.8.4 and 16.7.7, released in its March 2024 patch release.
What's affected
GitLab's patch release notes list these affected ranges:
- 11.3 up to but not including 16.7.7
- 16.7.6 up to but not including 16.8.4
- 16.8.3 up to but not including 16.9.2
Fixed versions are 16.7.7, 16.8.4 and 16.9.2. The GitLab release page rates it High with CVSS 3.1 score 7.7 and the vector AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N. The NVD record matches that score.
The title GitLab used for the issue refers to bypassing CODEOWNERS approval in a way that could allow theft of protected variables. That is the reason the scope is marked as changed.
How to check if you're exposed
For self managed GitLab, find the version in the Help page (the question mark menu, then Help), or on the server:
sudo gitlab-rake gitlab:env:info
Compare it with the fixed releases above. GitLab.com is run by GitLab and is not something you upgrade yourself. Also check whether you rely on CODEOWNERS with required approvals on protected branches, since that is the control this bug weakens.
What to do now
- Upgrade self managed GitLab to 16.9.2, 16.8.4 or 16.7.7, or to a newer release.
- List projects that rely on CODEOWNERS approvals and protected variables.
- Review recent merge requests to protected branches that came from older feature branches, and check that the approvals match the final content.
- Rotate protected CI variables if you find a merge that bypassed review.
- Consider requiring a pipeline check that compares merged content to the approved content.
Why it matters
The weakness is CWE-863, incorrect authorization. The system checks that someone with the right role approved a change, but the check can be satisfied in a way the owners never intended. Branch protection and code owner rules are control points for supply chain security, because they decide what code reaches builds that hold secrets.
A bypass of this control is not a code execution bug, but it can lead to unreviewed code in a protected branch and then to exposure of protected variables. The record does not mark the CVE as exploited in the wild. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan, and the Gold directory lists the CVE and CWE pages used here.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is GitLab.com affected?
GitLab runs GitLab.com itself and applies fixes there. The versions above matter for self managed installs.
Which release should I choose?
Use the fixed patch for the minor version you run, 16.7.7, 16.8.4 or 16.9.2, or move to a newer release.
Sources
Last reviewed: 19 October 2026.
