Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that under specific conditions could have allowed an unauthenticated user to join arbitrary organizations by changing headers on some requests.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GitLab | GitLab | 18.3 – < 18.4.5, 18.5 – < 18.5.3, 18.6 – < 18.6.1 | 18.4.5 |
Advisories 2
- NCSC-2025-0377 Kwetsbaarheden verholpen in GitLab NCSC-NL (Netherlands) · Nov 27, 2025
- WID-SEC-2025-2684 GitLab: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 26, 2025
References
- GitLab Security Release Blog Post vendor-advisory
- GitLab Issue #579372 issue-tracking permissions-required
- HackerOne Bug Bounty Report #3370245 technical-description exploit permissions-required