GitLab EE vulnerabilities

GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1. Under certain conditions, an authenticated user could have caused specific Duo AI workflows to run under another user's identity due to improper user identity resolution.

GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3. This issue could have allowed an authenticated user with developer-role permissions to execute arbitrary JavaScript in other users' browsers due to improper input sanitization.

GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3. In customizable analytics dashboards, an authenticated user could have executed arbitrary JavaScript in the context of other users' browsers due to improper input sanitization.

GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3. This issue could have allowed an authenticated user to execute arbitrary JavaScript in other users' browsers due to improper input sanitization.

GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with reporter-role permissions who authored a merge request could have reset merge request approval rules due to improper authorization checks.

GitLab EE versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 have a vulnerability that allows an authenticated user with developer role to execute arbitrary commands in a CI context. This occurs through the Claude agent processing configuration from a user-controlled source.

GitLab EE contains a DoS vulnerability in the SCIM user provisioning feature. An authenticated user can send specially crafted input causing an unbounded loop, leading to denial of service.

GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to bypass IP-based access restrictions and read limited merge request information from a private project due to missing authorization checks in a merge requests API endpoint.

GitLab has remediated an issue in GitLab EE affecting all versions from 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to view external status check configuration restricted to higher-privileged roles due to missing authorization on a merge request API endpoint.

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to cause AI usage to be attributed to another namespace, due to improper authorization of identity information supplied in requests.

In GitLab EE versions from 19.1 before 19.1.4 and 19.2 before 19.2.2, under certain conditions an authenticated user could read policy configuration belonging to a namespace they were not authorized to access due to incorrect authorization checks in a GraphQL query.

GitLab EE has a vulnerability in versions 15.6 through 19.0.6, 19.1 through 19.1.4, and 19.2 through 19.2.2 that under certain conditions could allow a user with pending membership to receive permissions granted by a custom role due to incorrect privilege assignment that did not account for membership state.

GitLab EE has a race condition in approval rule processing that under certain conditions allows an authenticated user to merge code into a protected branch without the required approvals. Affected versions are 17.0 through 19.0.4, 19.1 through 19.1.2, and 19.2 through 19.2.0.

An authorization flaw in GitLab EE allows an authenticated user with minimal permissions to read work item metadata from private projects. Affected versions: 18.9 to 18.11.7, 19.0 to 19.0.4, and 19.1 to 19.1.2.

A vulnerability in GitLab EE allows an authenticated user with developer role to execute arbitrary scripts in another user's browser session due to improper input sanitization. Affected versions: 13.11 to 18.11.7, 19.0 to 19.0.4, and 19.1 to 19.1.2.

An improper authorization vulnerability in GraphQL operations in GitLab EE allowed an authenticated user with auditor-level access to modify compliance violation records under certain conditions. Affected versions are 18.2 through 18.11.7, 19.0 through 19.0.4, and 19.1 through 19.1.2.

A vulnerability in GitLab EE allows an authenticated user with maintainer role to obtain another user's stored credentials under certain conditions due to improper authorization controls. Affected versions range from 9.5 to 18.11.7, 19.0 to 19.0.4, and 19.1 to 19.1.2.

An issue was found in GitLab EE that, under certain conditions, could allow an authenticated user with limited permissions to access project information due to insufficient authorization checks. It affects all versions from 18.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1.

GitLab has remediated an issue in GitLab EE affecting all versions from 13.1.4 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2. Under certain conditions, an authenticated user could have added unauthorized email addresses to a targeted user's account due to improper sanitization of user-supplied input in certain group setting fields.

GitLab has remediated an issue in GitLab EE affecting all versions from 13.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2. Under certain conditions, an authenticated user with Security Manager-role permissions could manage project security configuration even when the relevant feature was in a disabled state, due to incorrect authorization enforcement.

GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2. Under certain conditions, an authenticated user with developer-role permissions could execute arbitrary client-side code on behalf of a targeted user due to improper input sanitization in the Analytics Dashboard.

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user could have assigned compliance frameworks from namespaces they were not authorized to access to their own project, due to missing namespace validation on self-managed instances.

GitLab EE versions 18.2 to 18.8.9, 18.9 to 18.9.5, and 18.10 to 18.10.3 have a vulnerability in customizable analytics dashboards allowing an authenticated user to execute arbitrary JavaScript in other users' browsers due to improper input sanitization.

A vulnerability was found in GitLab EE due to incorrect authorization, which under certain circumstances allowed an authenticated user with auditor privileges to modify vulnerability flag data in private projects.

GitLab EE from versions 11.3 to 18.8.9, 18.9 to 18.9.5, and 18.10 to 18.10.3 contains a vulnerability that allows an authenticated user with developer role to modify protected environment settings due to improper authorization checks in the API.

In GitLab EE (versions 18.0.0-18.8.9, 18.9-18.9.5, 18.10-18.10.3), an authenticated user can leak IP addresses of users viewing Code Quality reports via specially crafted content.

In GitLab EE (versions 18.2-18.8.9, 18.9-18.9.5, 18.10-18.10.3), an authenticated user can cause a denial of service to the entire GitLab instance due to improper input validation in GraphQL queries.

In GitLab EE versions from 16.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3, an issue exists that under certain circumstances could allow an authenticated user to access other users' email addresses via GraphQL queries.

An authenticated user could access and utilize AI model settings from unauthorized namespaces by manipulating namespace identifiers in API requests. The issue affects GitLab EE versions 18.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1.

An information disclosure issue in GitLab EE affecting all versions from 16.2 prior to 16.2.5, and 16.3 prior to 16.3.1 allowed other Group Owners to see the Public Key for a Google Cloud Logging audit event streaming destination, if configured.

An issue has been discovered in GitLab EE affecting all versions from 16.1 to 16.1.5, from 16.2 to 16.2.5, and from 16.3 to 16.3.1. An external user with an owner role in a group may escalate their privileges by creating a service account in that group.

An issue has been discovered in GitLab EE affecting all versions from 14.1 before 16.0.8, from 16.1 before 16.1.3, and from 16.2 before 16.2.2. EE-licensed users could link any security policy project by its ID to projects or groups they have access to, potentially revealing the security project's configured security policies.

An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to run pipeline jobs as an arbitrary user via scheduled security scan policies.

An issue has been discovered in GitLab EE affecting all versions from 15.11 prior to 16.2.2 which allows an attacker to spike the resource consumption resulting in DoS.

An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Access tokens may have been logged when a query was made to a specific endpoint.

A sensitive information leak issue has been discovered in GitLab EE affecting all versions from 16.0 to 16.0.6 and from 16.1 to 16.1.1. It allows access to titles of private issues and MRs.

An issue has been discovered in GitLab EE affecting all versions starting from 12.8 before 15.11.11, all versions starting from 16.0 before 16.0.7, all versions starting from 16.1 before 16.1.2. An attacker could change the name or path of a public top-level group in certain situations.