GitLab EE vulnerabilities

GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3. This issue could have allowed an authenticated user with developer-role permissions to execute arbitrary JavaScript in other users' browsers due to improper input sanitization.

GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3. In customizable analytics dashboards, an authenticated user could have executed arbitrary JavaScript in the context of other users' browsers due to improper input sanitization.

GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3. This issue could have allowed an authenticated user to execute arbitrary JavaScript in other users' browsers due to improper input sanitization.

GitLab has remediated an issue in GitLab EE affecting versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could allow an authenticated user to bypass a required merge request approval policy on a protected branch due to improper access control during approval rule synchronization.

GitLab EE in versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 contains an issue that under certain conditions could allow an authenticated user to access paid AI features without a valid subscription due to insufficient server-side validation in billing eligibility checks.

GitLab EE contains a cleanup logic flaw that fails to distinguish pre-existing vulnerability records from newly created ones during error handling. Under certain conditions, an authenticated user with read-only permissions could permanently delete existing vulnerability records. This issue affects versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1.

GitLab has remediated an issue in GitLab EE affecting versions from 19.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 where, when an instance administrator locked a group's Duo availability, an authenticated user with group Owner permissions could re-enable AI-backed data egress to a third-party service for that group and its descendant projects, due to insufficient granularity of the admin-lock enforcement controls.

GitLab EE versions from 13.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 have a vulnerability that, under certain conditions, could allow an authenticated user with limited permissions to modify CI/CD deployment rollback settings without authorization, due to insufficient access control checks.

A vulnerability in GitLab EE could, under certain conditions, allow an authenticated user to inject specially crafted content into AI agent instructions, potentially causing unintended command execution attributed to other users. Affects versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

GitLab EE versions from 16.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 have a fixed issue that, under certain conditions, could allow an authenticated user to approve a merge request despite having contributed commits to it, due to improper identity resolution.

A vulnerability in GitLab EE could, under certain conditions, allow an authenticated user to execute arbitrary CI/CD pipelines in a transferred project with the new group's privileges. Affects versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

GitLab EE contains an improper authorization check that, under certain conditions, could allow an authenticated user with developer-role permissions to bypass admin-configured AI tool governance controls for workflows in namespaces they do not control. Affected versions are from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1.

GitLab EE versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 have a vulnerability that under certain conditions could allow an authenticated user to access sensitive CI/CD variable values from debug-mode job traces through the Duo AI troubleshooting feature due to missing authorization checks.

GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user with Owner or Maintainer permissions could have silently disabled protected environment deployment approval requirements, allowing unapproved deployments to reach production, due to improper access control checks performed after the protected resource was modified.

GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 under certain conditions could allow an authenticated user to achieve remote code execution by importing a specially crafted Git project export to overflow the Unicode conversion buffer used in Advanced Search indexing.

GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with reporter-role permissions who authored a merge request could have reset merge request approval rules due to improper authorization checks.

GitLab EE versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 have a vulnerability that allows an authenticated user with developer role to execute arbitrary commands in a CI context. This occurs through the Claude agent processing configuration from a user-controlled source.

GitLab EE contains a DoS vulnerability in the SCIM user provisioning feature. An authenticated user can send specially crafted input causing an unbounded loop, leading to denial of service.

GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to bypass IP-based access restrictions and read limited merge request information from a private project due to missing authorization checks in a merge requests API endpoint.

GitLab has remediated an issue in GitLab EE affecting all versions from 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to view external status check configuration restricted to higher-privileged roles due to missing authorization on a merge request API endpoint.

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to cause AI usage to be attributed to another namespace, due to improper authorization of identity information supplied in requests.

In GitLab EE versions from 19.1 before 19.1.4 and 19.2 before 19.2.2, under certain conditions an authenticated user could read policy configuration belonging to a namespace they were not authorized to access due to incorrect authorization checks in a GraphQL query.

GitLab EE has a vulnerability in versions 15.6 through 19.0.6, 19.1 through 19.1.4, and 19.2 through 19.2.2 that under certain conditions could allow a user with pending membership to receive permissions granted by a custom role due to incorrect privilege assignment that did not account for membership state.

GitLab EE has a race condition in approval rule processing that under certain conditions allows an authenticated user to merge code into a protected branch without the required approvals. Affected versions are 17.0 through 19.0.4, 19.1 through 19.1.2, and 19.2 through 19.2.0.

An authorization flaw in GitLab EE allows an authenticated user with minimal permissions to read work item metadata from private projects. Affected versions: 18.9 to 18.11.7, 19.0 to 19.0.4, and 19.1 to 19.1.2.

A vulnerability in GitLab EE allows an authenticated user with developer role to execute arbitrary scripts in another user's browser session due to improper input sanitization. Affected versions: 13.11 to 18.11.7, 19.0 to 19.0.4, and 19.1 to 19.1.2.

An improper authorization vulnerability in GraphQL operations in GitLab EE allowed an authenticated user with auditor-level access to modify compliance violation records under certain conditions. Affected versions are 18.2 through 18.11.7, 19.0 through 19.0.4, and 19.1 through 19.1.2.

A vulnerability in GitLab EE allows an authenticated user with maintainer role to obtain another user's stored credentials under certain conditions due to improper authorization controls. Affected versions range from 9.5 to 18.11.7, 19.0 to 19.0.4, and 19.1 to 19.1.2.

An issue was found in GitLab EE that, under certain conditions, could allow an authenticated user with limited permissions to access project information due to insufficient authorization checks. It affects all versions from 18.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1.

GitLab has remediated an issue in GitLab EE affecting all versions from 13.1.4 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2. Under certain conditions, an authenticated user could have added unauthorized email addresses to a targeted user's account due to improper sanitization of user-supplied input in certain group setting fields.

GitLab has remediated an issue in GitLab EE affecting all versions from 13.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2. Under certain conditions, an authenticated user with Security Manager-role permissions could manage project security configuration even when the relevant feature was in a disabled state, due to incorrect authorization enforcement.

GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2. Under certain conditions, an authenticated user with developer-role permissions could execute arbitrary client-side code on behalf of a targeted user due to improper input sanitization in the Analytics Dashboard.

GitLab EE has a vulnerability in versions from 18.7 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1. When foundational flows were enabled at the group level, an authenticated user with developer-role permissions could bypass flow restrictions under certain conditions.

GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1. Under certain conditions, an authenticated user could have caused specific Duo AI workflows to run under another user's identity due to improper user identity resolution.

GitLab has remediated an issue in GitLab EE affecting all versions from 11.5 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1. Under certain conditions, an authenticated user with developer-role permissions could access sensitive deployment data on projects due to improper authorization checks.

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user could have assigned compliance frameworks from namespaces they were not authorized to access to their own project, due to missing namespace validation on self-managed instances.

GitLab EE versions 18.2 to 18.8.9, 18.9 to 18.9.5, and 18.10 to 18.10.3 have a vulnerability in customizable analytics dashboards allowing an authenticated user to execute arbitrary JavaScript in other users' browsers due to improper input sanitization.

A vulnerability was found in GitLab EE due to incorrect authorization, which under certain circumstances allowed an authenticated user with auditor privileges to modify vulnerability flag data in private projects.

GitLab EE from versions 11.3 to 18.8.9, 18.9 to 18.9.5, and 18.10 to 18.10.3 contains a vulnerability that allows an authenticated user with developer role to modify protected environment settings due to improper authorization checks in the API.

In GitLab EE (versions 18.0.0-18.8.9, 18.9-18.9.5, 18.10-18.10.3), an authenticated user can leak IP addresses of users viewing Code Quality reports via specially crafted content.

In GitLab EE (versions 18.2-18.8.9, 18.9-18.9.5, 18.10-18.10.3), an authenticated user can cause a denial of service to the entire GitLab instance due to improper input validation in GraphQL queries.

In GitLab EE versions from 16.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3, an issue exists that under certain circumstances could allow an authenticated user to access other users' email addresses via GraphQL queries.

An authenticated user could access and utilize AI model settings from unauthorized namespaces by manipulating namespace identifiers in API requests. The issue affects GitLab EE versions 18.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1.

GitLab has remediated an issue in GitLab EE affecting all versions from 13.2 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to disclose sensitive information from private projects by executing specifically crafted GraphQL queries.

GitLab EE contained an issue that, under certain configuration conditions, could allow an authenticated user to view information from security reports. The issue affects versions from 13.7 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1. GitLab has remediated the issue.

GitLab EE versions from 17.8 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 contain a flaw that could allow an authenticated attacker to leak sensitive information from confidential issues by injecting hidden prompts into merge request comments.

GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.4, and 18.5 before 18.5.2. An authenticated user could gain CSRF tokens by exploiting improper input validation in repository references combined with redirect handling weaknesses.

An issue has been discovered in GitLab EE affecting all versions from 18.1 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2. Under certain circumstances, an attacker could have removed Duo flows belonging to another user.

GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.3, and 18.5 before 18.5.1. Under certain conditions, authenticated users could gain unauthorized project access by exploiting the access request approval workflow.

GitLab EE versions from 17.6.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 contained an issue that could allow an authenticated attacker to execute unauthorized quick actions by including malicious commands in specific descriptions. The issue has been remediated.