GitLab EE Incorrect Authorization Vulnerability in Workflows

A vulnerability exists in GitLab Enterprise Edition (EE) versions 18.1 prior to 18.3.6, 18.4 prior to 18.4.4, and 18.5 prior to 18.5.2. This vulnerability could have allowed an attacker to remove Duo authentication flows from another user under certain conditions.

Impact

Exploitation of this vulnerability could have led to unauthorized removal of Duo authentication flows from users, potentially disrupting their access or authentication processes.

Remediation

Users are advised to upgrade to GitLab versions 18.5.2, 18.4.4, or 18.3.6. Instructions for updating GitLab can be found on the GitLab Update page. For GitLab Runner, see the Updating the Runner page.