GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with developer-role permissions to bypass package protection rules due to improper access control.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NGitLab
APPGitlab18.3.0 – 18.9.7 (bez)18.10.0 – 18.10.6 (bez)18.11.0 – 18.11.3 (bez)
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
CI/CD
CWE
Related vulnerabilities
CVE-2023-7028CRITICAL10.0⚠ KEVPL ✓ten sam produkt
GitLab: Przejęcie konta przez reset hasła na niezweryfikowany e-mail
CVE-2021-22205CRITICAL10.0⚠ KEVten sam produkt
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properl...
CVE-2024-7102CRITICAL9.6PL ✓ten sam produkt
GitLab CE/EE: uruchomienie pipeline jako inny użytkownik (privilege escalation)
CVE-2024-9164CRITICAL9.6PL ✓ten sam produkt
GitLab EE: uruchamianie pipeline CI/CD na dowolnych gałęziach bez autoryzacji
CVE-2024-6678CRITICAL9.9PL ✓ten sam produkt
GitLab CE/EE — uruchomienie pipeline jako dowolny użytkownik (CWE-290)