Unauthenticated Work Item Access in GitLab CE/EE

Executive Summary

This vulnerability in GitLab CE/EE versions before 19.2.8, all 19.3 versions, and 19.4 before 19.4.2 allows an unauthenticated user to read work item contents from private groups and projects due to incorrect authorization checks.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves incorrect authorization checks in GitLab allowing unauthenticated access to private work item contents. To detect it, check GitLab server logs for unauthorized access attempts to work items in private groups or projects. Look for patterns like repeated requests to work item endpoints without valid authentication tokens.

Useful 0 Not Useful 0

Impact Analysis

An attacker could access sensitive work item data in private projects or groups without authentication, potentially exposing confidential information such as project details, discussions, or internal documents.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) requirements by exposing protected information without consent.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade GitLab to a patched version: 19.2.8, 19.3 (if available), or 19.4.2 or later to address the authorization flaw.

Useful 0 Not Useful 0