Volerion logoVolerion
Volerion logoVolerion

GitLab CE/EE Branch Name Confusion Vulnerability in Confidential Merge Requests

Vulnerability

A business logic error has been identified in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 12.1 prior to 17.10.7, 17.11 prior to 17.11.3, and 18.0 prior to 18.0.1. This vulnerability allows an attacker to create branch name confusion in confidential merge requests.

Impact

Exploitation of this vulnerability can lead to branch name confusion in confidential merge requests, potentially causing misunderstandings or miscommunications about the status or content of the merge request.

Added: Jun 9, 2025, 7:46 PM
Updated: Jun 9, 2025, 7:46 PM

Vulnerability Rating

Custom Algorithm
spread
7.3
impact
0.6
exploitability
5.2
remediation
0.0
relevance
0.0
threat
0.0
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.