GitLab EE Improper Authorization Vulnerability in Project Analytics Access

A vulnerability exists in GitLab EE versions 17.7 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1. This vulnerability allows users with planner roles to access sensitive project analytics data, specifically code review analytics, in private projects. This access is unauthorized, as the documentation states that such analytics should only be available to users with reporter roles or higher.

Impact

Exploitation of this vulnerability allows unauthorized access to code review analytics in private projects, which could lead to a misrepresentation of user roles and permissions.

Reproduction

To reproduce this vulnerability, a user with a planner role can be invited to a private project by a user with an ultimate plan. Once added, the planner role user can access the code review analytics section of the project, despite the documentation stating that this access should be restricted to users with reporter roles or higher.

Remediation

Users can update to GitLab EE versions 17.7.6, 17.8.4, or 17.9.1, where this vulnerability has been fixed.