High
check, gitlab — security advisory
Incorrect Authorization check affecting all versions of GitLab EE from 13.11 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2 allows group access tokens to continue working even after the group owner loses the ability to revoke them.
- Products
- check, gitlab
- Affected versions
- 0.10.0-3, 0.10.0-3build2, 0.15.2-2, 0.15.2-2build1, 0.15.2-3, 0.15.2-3build1, 0.9.10-6.1ubuntu1, 8.4.3+dfsg-12, 8.4.3+dfsg-9, 8.5.8+dfsg-5
- Fixed versions
- Not specified
- CVEs
- CVE-2022-4167
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 01:38 UTC · Revision 1
Source evidence
Incorrect Authorization check affecting all versions of GitLab EE from 13.11 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2 allows group access tokens to continue working even after the group owner loses the ability to revoke them.
osv:UBUNTU-CVE-2022-4167
check
Fixed versions: Not specified
gitlab
Fixed versions: Not specified
check
Fixed versions: Not specified
check
Fixed versions: Not specified
check
Fixed versions: Not specified
check
Fixed versions: Not specified
check
Fixed versions: Not specified
check
Fixed versions: Not specified
check
Fixed versions: Not specified
Complete source record
{
"id": "ebe35ea251ea3d589b8af016e404a2490001b3d08200a5076ee590f70caefab5",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-4167",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2022-4167",
"summary": "Incorrect Authorization check affecting all versions of GitLab EE from 13.11 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2 allows group access tokens to continue working even after the group owner loses the ability to revoke them.",
"evidence": "osv:UBUNTU-CVE-2022-4167",
"products": [
{
"name": {
"value": "check",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.9.10-6.1ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "0.10.0-3",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "gitlab",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "8.4.3+dfsg-9",
"evidence": "/affected/1/versions"
},
{
"value": "8.4.3+dfsg-12",
"evidence": "/affected/1/versions"
},
{
"value": "8.5.8+dfsg-5",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "check",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.10.0-3build2",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "check",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.10.0-3build2",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "check",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.15.2-2",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "check",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.15.2-2build1",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "check",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.15.2-3",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "check",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.15.2-3build1",
"evidence": "/affected/7/versions"
}
]
},
{
"name": {
"value": "check",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.15.2-3",
"evidence": "/affected/8/versions"
},
{
"value": "0.15.2-3build1",
"evidence": "/affected/8/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "UBUNTU-CVE-2022-4167",
"aliases": [
"UBUNTU-CVE-2022-4167"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "check",
"purl": "pkg:deb/ubuntu/check?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"0.9.10-6.1ubuntu1",
"0.10.0-3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-4167.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "check",
"binary_version": "0.10.0-3"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "gitlab",
"purl": "pkg:deb/ubuntu/gitlab?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"8.4.3+dfsg-9",
"8.4.3+dfsg-12",
"8.5.8+dfsg-5"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-4167.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "gitlab",
"binary_version": "8.5.8+dfsg-5"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "check",
"purl": "pkg:deb/ubuntu/check?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"0.10.0-3build2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-4167.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "check",
"binary_version": "0.10.0-3build2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "check",
"purl": "pkg:deb/ubuntu/check?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"0.10.0-3build2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-4167.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "check",
"binary_version": "0.10.0-3build2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "check",
"purl": "pkg:deb/ubuntu/check?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"0.15.2-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-4167.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "check",
"binary_version": "0.15.2-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "check",
"purl": "pkg:deb/ubuntu/check?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"0.15.2-2build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-4167.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "check",
"binary_version": "0.15.2-2build1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "check",
"purl": "pkg:deb/ubuntu/check?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"0.15.2-3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-4167.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "check",
"binary_version": "0.15.2-3"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "check",
"purl": "pkg:deb/ubuntu/check?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"0.15.2-3build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-4167.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "check",
"binary_version": "0.15.2-3build1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "check",
"purl": "pkg:deb/ubuntu/check?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"0.15.2-3",
"0.15.2-3build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-4167.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "check",
"binary_version": "0.15.2-3build1"
}
]
}
}
],
"modified": "2026-10-17T12:57:15.462717767Z",
"provider": "osv",
"upstream": [
"CVE-2022-4167"
],
"references": [
"https://ubuntu.com/security/CVE-2022-4167",
"https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4167.json",
"https://gitlab.com/gitlab-org/gitlab/-/issues/367740",
"https://www.cve.org/CVERecord?id=CVE-2022-4167"
]
},
"related_cves": [
{
"value": "CVE-2022-4167",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/1/score"
},
"source_id": "core-osv",
"document_id": 357040,
"published_at": "2023-01-12T04:15:00+00:00"
}