GitLab EE Group Invitation Bypass Vulnerability

A vulnerability exists in GitLab EE versions 18.0 prior to 18.0.4 and 18.1 prior to 18.1.2, allowing authenticated users with invitation privileges to bypass group-level user invitation restrictions. This is achieved by manipulating the group invitation functionality, particularly through an API endpoint that shares groups with groups.

Impact

Exploitation of this vulnerability allows users to invite groups to their own groups, bypassing restrictions meant to prevent such actions.

Reproduction

To reproduce this vulnerability, first activate a GitLab Ultimate trial for your group. Then, create a custom role for a user that includes the permission to manage group members. Assign this role to the user. Next, enable the 'Disable user invitations' feature in the group settings. Despite this feature being active, the user can still invite entire groups using a direct API request, effectively bypassing the restriction.

Remediation

Users can update to GitLab EE version 18.1.2 or 18.0.4, where this vulnerability has been fixed.