AI analysis
GitLab EE contains a missing-authorization flaw (CWE-862) in its compliance framework management controls. Under certain conditions, an authenticated user who has been granted the Security Manager role could bypass intended authorization checks and execute arbitrary CI/CD jobs in group projects and access protected CI/CD variables. Exploitation requires only network access and a valid authenticated account holding the Security Manager role, with no user interaction, per the CVSS vector. All GitLab Enterprise Edition versions from 18.11 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 are affected; only EE is named in the advisory. There is no known public proof-of-concept, the flaw is not in CISA KEV, and no in-the-wild exploitation has been reported.
What to do: Upgrade GitLab EE to 19.3.2, 19.2.6, or 19.1.8 (or later) depending on your version train, including deployments on the 18.11-19.1 releases. Until patched, audit which users hold the Security Manager custom role in each group and review recent CI/CD job runs and protected-variable access on group projects linked to compliance frameworks for signs of misuse.
Affected
| GitLab Enterprise Edition (EE) | all versions from 18.11 before 19.1.8; 19.2 before 19.2.6; 19.3 before 19.3.2 (fixed in 19.1.8, 19.2.6, and 19.3.2) |
Estimated exposure
largetens of thousands of self-managed GitLab EE instances — Internet-wide scans (e.g., Shodan) have historically indexed on the order of 50,000+ self-managed GitLab servers (CE and EE combined), and EE is common among organizational/paid deployments, so the EE-affected subset is plausibly in the…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
GitLab has remediated an issue in GitLab EE affecting all versions from 18.11 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user with the Security Manager role to execute arbitrary CI/CD jobs and access protected variables within group projects due to improper authorization controls on compliance framework management.