GitLab AI GraphQL Mutation Missing Authorization Vulnerability

A vulnerability exists in GitLab Enterprise Edition (EE) versions 18.5 prior to 18.5.5, 18.6 prior to 18.6.3, and 18.7 prior to 18.7.1. This vulnerability allows authenticated users to modify instance-wide AI feature provider settings by exploiting inadequate authorization checks in GraphQL mutations.

Impact

Exploitation of this vulnerability could lead to unauthorized modifications of AI feature provider settings, potentially affecting the behavior of AI functionalities across the GitLab instance.

Remediation

Users are advised to upgrade to GitLab EE versions 18.7.1, 18.6.3, or 18.5.5. Instructions for updating GitLab can be found on the GitLab Update page. After upgrading, ensure to run any necessary database migrations.