GitLab CI Job Mutation Access Control Vulnerability

A vulnerability exists in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 17.7 prior to 18.7.5, 18.8 prior to 18.8.5, and 18.9 prior to 18.9.1. This vulnerability allows an unauthorized user with Developer-role permissions to set pipeline variables for manually triggered jobs under certain conditions.

Impact

Exploitation of this vulnerability could lead to unauthorized modifications of pipeline variables, potentially affecting the behavior of CI jobs.

Remediation

Users are advised to upgrade to GitLab versions 18.9.1, 18.8.5, or 18.7.5. Instructions for updating GitLab can be found on the GitLab Update page.