BIT-GITLAB-2024-7296 Incorrect Authorization in GitLab

An issue was discovered in GitLab EE affecting all versions from 16.5 prior to 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2 which allowed a user with a custom permission to approve pending membership requests beyond the maximum number of allowed users...

CVE-2024-7296 Incorrect Authorization in GitLab

An issue was discovered in GitLab EE affecting all versions from 16.5 prior to 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2 which allowed a user with a custom permission to approve pending membership requests beyond the maximum number of allowed users...

CVE-2024-7296

GitLab EE contains CVE-2024-7296: affected releases are 16.5 up to 17.7.7, 17.8 up to 17.8.5, and 17.9 up to 17.9.2. A user with a custom permission could approve pending membership requests beyond the configured cap, potentially granting access beyond allowed users. This is described across mult...

Design/Logic Flaw

The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of actions such ...

PT-2023-15926

Name of the Vulnerable Software and Affected Versions WCFM Membership plugin for WordPress versions up to, and including, 2.10.0 Description The issue allows unauthorized modification and access of data due to missing capability checks on various AJAX actions. This enables unauthenticated attacke...