CVE-2016-4340

Public exploit available. Not confirmed exploited in the wild yet. A vendor fix is available.

CVSS 3.08.8High EPSS percentile96th10% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 2 sources FixVendor fixNo build named by the sources

Published 2017-01-23Updated 2026-05-13Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check your GitLab version and whether any accounts can use the impersonation feature.
Upgrade the affected branch to 8.2.5, 8.3.9, 8.4.10, 8.5.12, 8.6.8, or 8.7.1.
Until upgraded, restrict impersonation permissions to only essential administrators and review recent impersonation use.

Vendor advisory Some work to apply

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8.3.8, and 8.2.0 through 8.2.4 allows remote authenticated users to "log in" as any other user via unspecified vectors.

In plain language

Written by AI from the record

This affects GitLab 8.2.0 through 8.7.0 and lets a suitably privileged account take over any user account; upgrade if you still run these old versions.

Authenticated account impersonation in GitLab permits a user with permission to use the impersonation feature to assume any other account’s identity over the network.

If you're affected

Any-user account takeover
Project data exposure
Unauthorized code changes
Service disruption

What is it

GitLab’s account-switching feature can be abused by someone who already has enough access to use it. It is like giving a staff member a master key that can open every office, including the owner’s office.

Who is affected

This matters to you if you run GitLab, especially one of the affected older releases. It can expose source code, projects, and actions performed under other employees’ accounts. It is only a risk if an attacker has a valid account with enough permission to use the impersonation feature.

How urgent is it

Public attack code is available, so treat this as an amber-priority upgrade rather than a routine maintenance task. It is not listed in CISA’s catalog of vulnerabilities known to be exploited, but privileged GitLab accounts should be reviewed while the upgrade is scheduled.

What to do — in detail

Confirm the installed GitLab version and identify roles or accounts permitted to use impersonation. Upgrade each affected maintenance branch to its corresponding fixed version: 8.2.5, 8.3.9, 8.4.10, 8.5.12, 8.6.8, or 8.7.1; if moving from these legacy releases to a current GitLab version, follow GitLab’s supported staged upgrade path and review release notes for breaking changes. If patching is delayed, remove or tightly limit impersonation permission and apply the vendor’s published workaround guidance. Review audit records for impersonation activity and unexpected actions performed as administrator, owner, or other sensitive accounts. No CISA KEV remediation due date applies because this CVE is not listed in KEV.

Technical context

CVSS v3.0 is 8.8 (High): AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The flaw is associated with CWE-264 and allows authenticated, sufficiently privileged users to impersonate arbitrary GitLab users, resulting in complete control over those accounts and their data or actions. Two public exploits are known. EPSS is 7.8% (94th percentile) and rising; this is predictive only, and the available findings do not confirm exploitation in the wild. CISA KEV does not list this CVE.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

2 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

10% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

A public exploit existed 67 days before the patch.

2026-09-23EPSS band change0 → moderateepss band change
2026-09-21EPSS band changemoderate → 0epss band change
2026-09-06EPSS band change0 → moderateepss band change
2026-09-05EPSS band changemoderate → 0epss band change
2026-08-31EPSS band change0 → moderateepss band change
2026-08-29EPSS band changemoderate → low

Affected products

gitlabcommercial · NLaka gitlab ce/ee
- gitlabWeb AppSaaSDevTools & CI / ci-cd

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 8.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

CWE-264No name in the record

Sources

References in the record

And 1 more reference. See all after sign-in

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Gitlab, not every advisory. This one: public exploit.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account