EUVD-2025-208995
GHSA-8jj8-qh37-33q3
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
5DescriptionNVD
GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that under certain conditions could have allowed an authenticated user with Planner role to view security category metadata and attributes in group security configuration due to improper access control
AnalysisAI
An improper access control vulnerability in GitLab EE allows authenticated users with the Planner role to view sensitive security category metadata and attributes in group security configurations they should not have access to. Affected versions include GitLab 18.6 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1. While the CVSS score is moderate at 4.3 (low confidentiality impact), a publicly available proof-of-concept exists and the vulnerability represents a straightforward privilege escalation through role-based access control bypass.
Technical ContextAI
This vulnerability is rooted in CWE-862: Missing Authorization, which occurs when a software system fails to properly enforce access control policies at the application level. The issue affects GitLab EE's group security configuration module, specifically the security category metadata display logic. The Planner role in GitLab is designed with limited permissions for planning and scheduling features, but the flawed authorization checks in the security configuration endpoint allow Planner-role users to bypass role-based access controls (RBAC) and retrieve security-sensitive metadata that should be restricted to higher-privileged roles such as Owners or Security Administrators. The vulnerability affects GitLab instances running the affected versions as identified in CPE notation cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*, requiring only network access and valid user credentials to exploit.
RemediationAI
Upgrade to patched versions immediately: GitLab EE 18.8.7 or later for the 18.8 branch, 18.9.3 or later for the 18.9 branch, or 18.10.1 or later for the 18.10 branch. Follow the vendor patch release notes at https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released/ for upgrade procedures and any breaking changes. If immediate patching is not feasible, implement a compensating control by auditing and restricting the Planner role assignment to users who genuinely require planning features only, and ensure that security administrators monitor group security configuration access logs for unauthorized viewing patterns. Additionally, enforce network-level access controls to limit who can authenticate to the GitLab instance, and consider implementing an API gateway to restrict access to group security endpoints based on user roles.
More from same product – last 7 days
Command injection in Prefect 3.6.18's GitHub integration allows authenticated users to execute arbitrary git commands th
Incorrect authorization enforcement in GitLab CE/EE permits a blocked Project Access Token to continue reading private p
Identity confusion in GitLab EE's Duo AI workflow runners lets an authenticated, low-privileged user cause specific Duo
Denial of service in GitLab CE/EE affects all versions from 17.1 through those prior to 18.10.7, 18.11.4, and 19.0.1, al
Unauthorized private project enumeration in GitLab CE/EE exposes confidential project metadata to unauthenticated networ
Share
External POC / Exploit Code
Leaving vuln.today