CVE-2024-1299 is a medium severity privilege escalation in GitLab, scored 6.5. In versions 16.8 before 16.8.4 and 16.9 before 16.9.2, a user with the custom role permission manage_group_access_tokens could rotate group access tokens with owner privileges. Upgrade to 16.8.4, 16.9.2 or later.
What's affected
GitLab's March 2024 patch release notice says the issue affects 16.8 prior to 16.8.4 and 16.9 prior to 16.9.2. The record states the same ranges. Other release lines are not listed.
The problem involves custom roles. A user with a custom role that grants manage_group_access_tokens was able to rotate group access tokens and receive tokens with owner level privileges. GitLab rates it medium, with a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N and a score of 6.5, which matches NVD.
The notice says the issue is mitigated in the latest release and credits a reporter through the GitLab HackerOne bug bounty program. It lists fixes in 16.9.2, and the record gives 16.8.4 for the older line. I read only the 16.9.2 page, so confirm 16.8.4 in GitLab's own release notes.
Weakness class: CWE-268. The NVD record carries the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N and a score of 6.5.
How to check if you're exposed
Sign in as an administrator. The GitLab version appears on the Admin Area dashboard, and on the Help page for any user. On a self-managed Linux package install you can also run:
sudo gitlab-rake gitlab:env:info
If you run 16.8.x below 16.8.4 or 16.9.x below 16.9.2, you are in range. Then see whether anyone holds the manage_group_access_tokens permission through a custom role, since that is the only path the notice describes. GitLab.com is managed by GitLab.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan for the libraries in your own projects, and reachability analysis helps you tell which findings your code actually calls.
What to do now
- Upgrade self-managed GitLab to 16.8.4, 16.9.2 or later.
- List custom roles that include manage_group_access_tokens and who holds them.
- Rotate group access tokens that were issued while a vulnerable version ran, and review who created them.
- Check audit events for group token rotations by users who are not owners.
- Keep a regular upgrade window so the next patch release is not a scramble.
Why it matters
The class is CWE-268, privilege chaining. A permission that looks narrow, here managing group tokens, combined with another feature to give more power than intended. Rotating a token handed back a token with owner privileges.
The score is medium because the attacker already needs a privileged custom role. Even so, group tokens often hold broad access to repositories and CI, so a chain from a limited role to owner rights deserves attention in any shared GitLab. The KEV flag is false and the notice does not report exploitation.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which versions fix CVE-2024-1299?
16.9.2 for the 16.9 line, per GitLab's notice, and 16.8.4 for the 16.8 line, per the record.
Who is at risk?
Only instances with a custom role that grants manage_group_access_tokens, as described in the notice.
Sources
Last reviewed: 19 October 2026.
