GitLab CE/EE Information Disclosure Vulnerability via GraphQL WebSocket Subscriptions

A vulnerability allowing information disclosure has been identified in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 16.7 prior to 18.3.6, 18.4 prior to 18.4.4, and 18.5 prior to 18.5.2. This vulnerability could have permitted a blocked user to access sensitive information by initiating GraphQL subscriptions through WebSocket connections.

Impact

Exploitation of this vulnerability could have led to unauthorized access to sensitive information.

Remediation

Users are advised to upgrade to GitLab versions 18.5.2, 18.4.4, or 18.3.6. Instructions for updating GitLab can be found on the GitLab Update page. For GitLab Runner, see the Updating the Runner page.