GitLab CE/EE Credential Theft Vulnerability Allowing Privilege Escalation

A vulnerability exists in GitLab CE/EE versions 18.4 prior to 18.4.5, 18.5 prior to 18.5.3, and 18.6 prior to 18.6.1. This issue could have allowed an authenticated user to extract credentials from users with higher privileges and to act on their behalf, under certain conditions.

Impact

Exploitation of this vulnerability could lead to unauthorized access to higher-privileged users' credentials, allowing for actions to be performed in their context.

Remediation

Users can upgrade to GitLab CE/EE versions 18.4.5, 18.5.3, or 18.6.1 to address this vulnerability.