{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "versions": [
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.0.0"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.0.0"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.0.1"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.0.1"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.0.2"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.0.2"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.0.3"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.0.3"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.0.4"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.0.4"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.0.5"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.0.5"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.0.6"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.0.6"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.0.7"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.0.7"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.0.8"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.0.8"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.0.9"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.0.9"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.0.10"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.0.10"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.1.0"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.1.0"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.1.1"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.1.1"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.1.2"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.1.2"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.1.3"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.1.3"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.1.4"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.1.4"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.1.5"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.1.5"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.1.6"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.1.6"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.1.7"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.1.7"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.2.0"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.2.0"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.2.1"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.2.1"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.2.2"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.2.2"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.2.3"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.2.3"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.2.4"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.2.4"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.2.5"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.2.5"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.2.6"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.2.6"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.2.7"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "9.2.7"
              }
            ]
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "f33774cb120324d428dabf52c89b8a65e4d4c166"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "f33774cb120324d428dabf52c89b8a65e4d4c166"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "7618f7fd87246cf0395c10162bc0fc3b3530a640"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "7618f7fd87246cf0395c10162bc0fc3b3530a640"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "3ed621894dca29a611a8f961aa5b30d4471034a6"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "3ed621894dca29a611a8f961aa5b30d4471034a6"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "254edd7e165c5f2d0fc59ca92a2970fcde63705d"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "254edd7e165c5f2d0fc59ca92a2970fcde63705d"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "349b042ecfdba96be85b32a50f16ed81b18db392"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "349b042ecfdba96be85b32a50f16ed81b18db392"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "71d72c9b0f74f06eee847fe04cfcdcb88529bf5c"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "71d72c9b0f74f06eee847fe04cfcdcb88529bf5c"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "7dffbc82afdd8696a032d6701021d6252f9bdda9"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "7dffbc82afdd8696a032d6701021d6252f9bdda9"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "3e10198a2bd4373ca72321ce5efcc87c4242ec06"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "3e10198a2bd4373ca72321ce5efcc87c4242ec06"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "cd94d5d57387b65171621d042e57d4e2e174683b"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "cd94d5d57387b65171621d042e57d4e2e174683b"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "c1923d5b0b6ee1f6546fbd3283c9e86f0cc9a272"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "c1923d5b0b6ee1f6546fbd3283c9e86f0cc9a272"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "6afd6e1a69a923a139e6b211e596c564ff5fa0c9"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "6afd6e1a69a923a139e6b211e596c564ff5fa0c9"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "a515b56a128da5bace23d4b475030b91e87b9606"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "a515b56a128da5bace23d4b475030b91e87b9606"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "43c23ff4e25b10ef98ff600f522fc4dd3ea49c46"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "43c23ff4e25b10ef98ff600f522fc4dd3ea49c46"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "64880437ba912cd3bb2f845dbf0ce3c757259c13"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "64880437ba912cd3bb2f845dbf0ce3c757259c13"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "e28218ce5d0903550e09909a96d2c84b520de710"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "e28218ce5d0903550e09909a96d2c84b520de710"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "cd361c2682fef6211b8a6cd33371ba4e2273a296"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "cd361c2682fef6211b8a6cd33371ba4e2273a296"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "f7c4d7bbe1d41c8bd199267b60991dc4e0564429"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "f7c4d7bbe1d41c8bd199267b60991dc4e0564429"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "5c046e9fa619929bfbaeea532a364dbe92a67553"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "5c046e9fa619929bfbaeea532a364dbe92a67553"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "6f5de11fb813898f351a8889e2e5085579a61fa6"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "6f5de11fb813898f351a8889e2e5085579a61fa6"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "4784d7896d755f282c6c629d236a4583ae45842b"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "4784d7896d755f282c6c629d236a4583ae45842b"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "b0dd8f61df35f675c3d63403b5126ec8c653926a"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "b0dd8f61df35f675c3d63403b5126ec8c653926a"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "b0041675fdc77967f3266c471d5342773185556e"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "b0041675fdc77967f3266c471d5342773185556e"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "43819e684ec17b7604eae5f2dd19894ceba1ced2"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "43819e684ec17b7604eae5f2dd19894ceba1ced2"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "c771fef92984df3767dd004575457ae631607f6a"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "c771fef92984df3767dd004575457ae631607f6a"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "915a0aa9da64dbf5425673e27198ebd5fc4b0c36"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "915a0aa9da64dbf5425673e27198ebd5fc4b0c36"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "0f19285bb8cb0d8abc936af7cb077c82d819a391"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "0f19285bb8cb0d8abc936af7cb077c82d819a391"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "61fee1520adef668450ae7315423542065d05028"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "61fee1520adef668450ae7315423542065d05028"
            }
          ],
          "repo": "https://gitlab.com/gitlab-org/gitlab",
          "type": "GIT"
        }
      ]
    }
  ],
  "details": "GitLab Community Edition (CE) and Enterprise Edition (EE) before 9.0.11, 9.1.8, 9.2.8 allow an authenticated user with the ability to create a group to add themselves to any project that is inside a subgroup.",
  "id": "CVE-2017-11438",
  "modified": "2026-03-13T21:54:47.667841863Z",
  "published": "2017-08-02T19:29:00.837Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://about.gitlab.com/2017/07/19/gitlab-9-dot-3-dot-8-released/"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}