Improper Authorization in GitLab EE Group SAML

Executive Summary

This vulnerability in GitLab EE affects versions from 15.5 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2. It allows an authenticated user with the group Owner role to potentially take over another group member's GitLab account. This occurs due to improper authorization in the Group SAML identity management functionality.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to a high-impact security breach where an attacker with Owner role privileges can hijack another group member's account. This compromises confidentiality and integrity of user accounts and data within GitLab, potentially allowing unauthorized access to sensitive information and actions performed under the hijacked account.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade GitLab EE to a fixed version. Specifically, update to version 18.10.8 or later if you are using the 18.10 series, 18.11.5 or later if using the 18.11 series, or 19.0.2 or later if using the 19.0 series.

This vulnerability affects versions from 15.5 before the fixed versions mentioned above and allows an authenticated user with group Owner role to take over another group member's account due to improper authorization in Group SAML identity management.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an authenticated user with group Owner role to take over another group member's GitLab account due to improper authorization in the Group SAML identity management functionality.

Such unauthorized account takeover could lead to unauthorized access to sensitive data, potentially violating data protection regulations such as GDPR and HIPAA, which require strict access controls and protection of personal and health information.

Therefore, this vulnerability could negatively impact compliance with these common standards and regulations by exposing sensitive information to unauthorized users.

Useful 0 Not Useful 0