Description
An issue has been discovered in GitLab CE/EE affecting all versions from 15.1 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed authenticated users to view administrator-only maintenance notes by accessing runner details through specific interfaces.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GitLab | GitLab | 15.1 – < 18.1.6, 18.2 – < 18.2.6, 18.3 – < 18.3.2 | 18.1.6 |
Advisories 2
- NCSC-2025-0288 Kwetsbaarheden verholpen in GitLab CE/EE NCSC-NL (Netherlands) · Sep 12, 2025
- WID-SEC-2025-2024 GitLab: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 11, 2025
References
- https://about.gitlab.com/releases/2025/09/10/patch-release-gitlab-18-3-2-released/
- GitLab Issue #551957 issue-tracking permissions-required
- HackerOne Bug Bounty Report #3173328 technical-description exploit permissions-required