GitLab EE Incorrect Authorization Vulnerability in Pipeline Builds

A vulnerability exists in GitLab Enterprise Edition (EE) versions 10.6 prior to 18.3.5, 18.4 prior to 18.4.3, and 18.5 prior to 18.5.1. This vulnerability allows authenticated users to trigger unauthorized pipeline executions by manipulating commits. The issue has been addressed in the latest patch releases.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of pipeline jobs, potentially allowing for misuse of CI/CD resources or execution of malicious code in the pipeline environment.

Remediation

Users are advised to upgrade to GitLab EE versions 18.5.1, 18.4.3, or 18.3.5. Instructions for updating GitLab can be found on the GitLab Update page. For GitLab Runner, refer to the Updating the Runner page.