GitLab CE/EE Pipeline Schedules API Authorization Bypass Vulnerability

An authorization bypass vulnerability has been identified in the Pipeline Schedules API of GitLab Community Edition (CE) and Enterprise Edition (EE). This vulnerability affects all versions from 17.11 prior to 18.6.6, 18.7 prior to 18.7.4, and 18.8 prior to 18.8.4. Under certain conditions, the vulnerability could have allowed an authenticated user to view specific pipeline values by querying the API.

Impact

Exploitation of this vulnerability could lead to unauthorized access to certain pipeline values, potentially exposing sensitive information or disrupting pipeline operations.

Remediation

Users are advised to upgrade to GitLab versions 18.8.4, 18.7.4, or 18.6.6. Instructions for updating GitLab can be found on the GitLab Update page.