GitLab CE/EE Information Disclosure Vulnerability Through API Error Messages

A vulnerability exists in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 17.5 prior to 18.4.6, 18.5 prior to 18.5.4, and 18.6 prior to 18.6.2. This vulnerability allows an authenticated user to access the names of private projects they do not have permission to view, through API requests. The issue arises from improper handling of error messages, which can inadvertently reveal project information.

Impact

Exploitation of this vulnerability could lead to unauthorized access to the names of private projects, potentially allowing users to gather information about projects they do not have access to.

Remediation

Users are advised to upgrade to GitLab versions 18.6.2, 18.5.4, or 18.4.6. Instructions for updating GitLab can be found on the GitLab Update page. For GitLab Runner, see the Updating the Runner page.