Description
An issue has been discovered in GitLab CE/EE affecting all versions from 17.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could have allowed an authenticated user to gain unauthorized access to confidential issues by creating a project with an identical name to the victim's project.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GitLab | GitLab | 17.10 – < 18.2.7, 18.3 – < 18.3.3, 18.4 – < 18.4.1 | 18.2.7 |
Advisories 2
- WID-SEC-2025-2140 GitLab: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 27, 2025
- NCSC-2025-0300 Kwetsbaarheden verholpen in GitLab EE & CE NCSC-NL (Netherlands) · Sep 29, 2025
References
- GitLab Issue #544926 issue-tracking permissions-required
- HackerOne Bug Bounty Report #3019236 technical-description exploit permissions-required