GitLab vulnerabilities

GitLab CE/EE versions from 18.6 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 contain a vulnerability that could allow an individual with knowledge of a victim's credential ID to bypass two-factor authentication by submitting forged device responses.

GitLab CE/EE versions from 17.7 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 contain a vulnerability that could allow an unauthenticated user to cause a denial of service condition by exploiting incorrect authorization validation in API endpoints.

GitLab CE/EE versions from 11.9 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 contain a vulnerability that could allow an unauthenticated user to create a denial of service condition by sending crafted requests with malformed authentication data.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated user to execute stored cross-site scripting through improper input validation in the Kubernetes proxy functionality.

Multiple versions of GitLab expose a dangerous method that could lead to the deletion of all Issue and MergeRequest objects by any authenticated user. For publicly available projects, this vulnerability could be exploited by unauthenticated users.

The impersonate feature in Gitlab versions 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8.3.8, and 8.2.0 through 8.2.4 allows remote authenticated users to 'log in' as any other user via unspecified vectors.

GitLab CE/EE versions from 19.2 to 19.2.8, 19.3 to 19.3.5, and 19.4 to 19.4.2 contain a vulnerability that, under certain conditions, could allow an unauthenticated user to execute arbitrary code on the GitLab server. The issue stems from insufficient validation of regular expressions in CI/CD configuration.

GitLab EE contains a vulnerability that allows an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials. The attacker uses a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.

A vulnerability in GitLab CE/EE allows an unauthenticated user to read confidential notes on public projects due to incorrect authorization checks. Affects versions from 17.4 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

A vulnerability in GitLab CE/EE allows an authenticated user with Guest access to read confidential epic content meant to be restricted by external authorization, due to incorrect authorization checks. Affects versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

A vulnerability in GitLab CE/EE allows an authenticated user with a project-scoped fine-grained Personal Access Token to permanently delete or modify group-level labels, due to incorrect authorization logic on label ownership scope validation. Affects versions from 18.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

A vulnerability in GitLab EE allows an authenticated user holding a specific granular permission to obtain a GitLab Duo Agent Platform token that bypasses governance controls, due to reliance on untrusted input in a security decision. Affects versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

A vulnerability in GitLab EE allows an authenticated user holding a custom role with compliance framework administration permissions to configure and execute a specially crafted compliance pipeline across group projects due to improper privilege assignment. Affects versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

A vulnerability in GitLab CE/EE allows an authenticated user with access to GitLab Pages log data to obtain access tokens and other secrets, due to insertion of sensitive request data into log files and error tracking events. Affects versions from 12.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that when importing CSV files could have allowed an authenticated user to cause denial of service to Sidekiq workers due to improper validation of CSV file structure.

GitLab CE/EE contains a missing authorization check on linked work items within visible epics. An authenticated user could read private child issue contents, including titles and descriptions, from projects they had no access to.

GitLab CE/EE has a vulnerability allowing arbitrary JavaScript execution in another user's browser session due to improper sanitization of path components in the merge request diff viewer. Affects versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1.

A vulnerability in GitLab CE/EE allows an unauthenticated user to read CI/CD job trace contents containing sensitive variable values due to improper authorization enforcement in the GraphQL API.

GitLab EE contains improper authorization enforcement. An authenticated user with guest-level permissions could read private security policy content they were not authorized to access.

GitLab has fixed an issue in GitLab CE/EE affecting all versions from 18.3 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1. Under certain conditions, an authenticated user with an MCP-scoped token could perform actions beyond the intended scope of that token due to improper authorization checks.

GitLab has fixed an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1. Under certain conditions, an authenticated user could spoof merge request authorship and attribute content to arbitrary existing users due to improper reliance on ephemeral cache state during Direct Transfer imports.

GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, could have allowed an authenticated user with developer permissions to execute a policy test pipeline on projects within their group and access protected CI/CD variables restricted to higher-privileged roles, due to insufficient scope validation.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user could have induced a targeted user to perform unintended state-changing HTTP requests due to improper sanitization of user-controlled data in the Markdown JSON table renderer.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user with project-level permissions to access restricted file contents on the server or cause denial of service due to improper validation of parameters in the Terraform state upload functionality.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL complexity calculation logic.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to execute arbitrary JavaScript in the context of a targeted user's session due to improper sanitization of pasted HTML content in the Content Editor.

GitLab has remediated an issue in GitLab EE affecting all versions from 18.11 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user with the Security Manager role to execute arbitrary CI/CD jobs and access protected variables within group projects due to improper authorization controls on compliance framework management.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL complexity calculation logic.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed a developer user to perform actions in the context of another user's merge request commit due to a race condition issue in pipeline creation.

GitLab CE/EE versions from 18.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 have a vulnerability that under certain conditions could have allowed an authenticated user to bypass SAML SSO sign-in restrictions and authenticate without SSO due to missing authentication enforcement checks.

GitLab CE/EE versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 contain a vulnerability that, under certain conditions, could allow an authenticated user to cause a denial of service affecting background job processing due to missing object count limits.

GitLab EE versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 contain a vulnerability that, under certain conditions, could allow an authenticated user with project Maintainer permissions to access the terminal of a protected environment they were not authorized to use due to improper authorization checks.

GitLab EE versions from 19.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 contain a vulnerability that, under certain conditions, could allow an authenticated user with developer-role permissions to influence the execution environment of Pipeline Execution Policy enforcement jobs due to improper handling of job dependencies.

GitLab CE/EE versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 have a path traversal vulnerability in the package registry that under certain conditions could allow an authenticated user to achieve remote code execution.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request validation in GraphQL multiplex query handling.

GitLab EE versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 have a remediated issue that under certain conditions could have allowed an authenticated user to modify project settings restricted to higher-privileged roles, due to missing authorization checks on a project update endpoint.

GitLab CE/EE versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 have a remediated issue that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled values rendered in table cell content by an analytics dashboard component.

GitLab CE/EE versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 have a remediated issue that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled data rendered in pagination controls by an analytics dashboard component.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer role to modify certain package registry metadata without the required maintainer-level permissions due to improper authorization checks.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to improper input validation.

GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to view restricted configuration settings due to improper authorization checks on a group settings page.

GitLab CE/EE versions from 19.2 before 19.2.2 have a vulnerability that under certain conditions could allow an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal.

GitLab CE/EE versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 have a vulnerability that under certain conditions could allow an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without the required push permissions due to improper authorization in pipeline reference validation.

GitLab CE/EE versions 10.1.0 through 19.0.5, 19.1 through 19.1.3, and 19.2 through 19.2.1 have insufficient access controls on internal request handling, potentially allowing an authenticated Developer user to access unauthorized information.

GitLab CE/EE has an improper access control vulnerability. An authenticated user with guest role could, under certain conditions, access test report contents they were not authorized to view.

GitLab CE/EE has a Cross-Site Scripting (XSS) vulnerability. An attacker can execute arbitrary JavaScript in another user's browser via a crafted URL due to improper input sanitization.