EUVD-2025-208995
GHSA-8jj8-qh37-33q3
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
4Description
GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that under certain conditions could have allowed an authenticated user with Planner role to view security category metadata and attributes in group security configuration due to improper access control
Analysis
An improper access control vulnerability in GitLab EE allows authenticated users with the Planner role to view sensitive security category metadata and attributes in group security configurations they should not have access to. Affected versions include GitLab 18.6 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1. While the CVSS score is moderate at 4.3 (low confidentiality impact), a publicly available proof-of-concept exists and the vulnerability represents a straightforward privilege escalation through role-based access control bypass.
Technical Context
This vulnerability is rooted in CWE-862: Missing Authorization, which occurs when a software system fails to properly enforce access control policies at the application level. The issue affects GitLab EE's group security configuration module, specifically the security category metadata display logic. The Planner role in GitLab is designed with limited permissions for planning and scheduling features, but the flawed authorization checks in the security configuration endpoint allow Planner-role users to bypass role-based access controls (RBAC) and retrieve security-sensitive metadata that should be restricted to higher-privileged roles such as Owners or Security Administrators. The vulnerability affects GitLab instances running the affected versions as identified in CPE notation cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*, requiring only network access and valid user credentials to exploit.
Affected Products
GitLab Enterprise Edition versions are affected across three release branches: GitLab 18.6 through 18.8.6 (patched in 18.8.7), GitLab 18.9 through 18.9.2 (patched in 18.9.3), and GitLab 18.10 through 18.10.0 (patched in 18.10.1). The vulnerability is confirmed via CPE cpe:2.3:a:gitlab:gitlab with the affected version ranges noted above. Community Edition and other GitLab deployments are not affected, as the vulnerability is specific to EE functionality. Patch releases are available as documented in the GitLab release announcement at https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released/.
Remediation
Upgrade to patched versions immediately: GitLab EE 18.8.7 or later for the 18.8 branch, 18.9.3 or later for the 18.9 branch, or 18.10.1 or later for the 18.10 branch. Follow the vendor patch release notes at https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released/ for upgrade procedures and any breaking changes. If immediate patching is not feasible, implement a compensating control by auditing and restricting the Planner role assignment to users who genuinely require planning features only, and ensure that security administrators monitor group security configuration access logs for unauthorized viewing patterns. Additionally, enforce network-level access controls to limit who can authenticate to the GitLab instance, and consider implementing an API gateway to restrict access to group security endpoints based on user roles.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today