AI analysis
GitLab Community and Enterprise Editions contain an improper authorization flaw (CWE-201, insertion of sensitive information into sent data) on internal data emission endpoints, affecting all versions from 10.1.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. Under certain conditions, an attacker with an authenticated account could reach these endpoints directly, bypassing the expected proxy path, and retrieve sensitive credentials and tokens exposed in the emitted data. The issue is rated medium severity (CVSS 3.1 score 5.3, confidentiality-only impact), but stolen tokens could enable follow-on compromise of accounts, CI/CD pipelines, or integrated systems. Fixes shipped in versions 19.1.8, 19.2.6, and 19.3.2. No public proof-of-concept exists, the CVE is not on CISA's KEV list, and no exploitation has been reported.
What to do: Upgrade self-managed GitLab instances to 19.3.2, 19.2.6, or 19.1.8 or later immediately; GitLab.com is already patched by the vendor. After patching, rotate credentials and tokens that transit internal endpoints (CI/CD variables, runner tokens, personal/group access tokens) as a precaution. Review audit and access logs for anomalous authenticated requests to internal data emission endpoints.
Affected
| GitLab CE/EE | 10.1.0 up to (excluding) 19.1.8 |
| GitLab CE/EE | 19.2.0 up to (excluding) 19.2.6 |
| GitLab CE/EE | 19.3.0 up to (excluding) 19.3.2 |
Estimated exposure
largetens of thousands of internet-exposed self-managed GitLab instances (order 10k–100k systems), plausibly representing millions of downstream users — Public internet scans (Shodan/Censys) routinely show tens of thousands of GitLab web interfaces exposed, and the vulnerable range spans nearly every release since 10.1.0 (2017), so most unpatched self-managed deployments are affected.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that certain conditions could have allowed an authenticated user to access sensitive credentials and tokens without transiting the expected proxy due to improper authorization checks on internal data emission endpoints.