Executive Summary

This vulnerability in GitLab EE affects versions from 11.3 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3. It allows an authenticated user with developer-role permissions to modify protected environment settings. This happens because of improper authorization checks in the API, which means the system does not correctly verify if the user has the right to make such changes.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can impact you by allowing users with developer-level access to change protected environment settings that they should not be able to modify. This could lead to unauthorized changes in deployment or operational environments, potentially causing disruptions, misconfigurations, or security risks within your development and deployment workflows.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade GitLab EE to a fixed version. Specifically, update to version 18.8.9 or later if you are on the 18.8 branch, 18.9.5 or later if on the 18.9 branch, or 18.10.3 or later if on the 18.10 branch. These versions contain the fix for the improper authorization checks that allowed developer-role users to modify protected environment settings.

Useful 0 Not Useful 0