Volerion logoVolerion
Volerion logoVolerion

GitLab CE/EE Role Restriction Bypass Vulnerability in Incident Work Items

Vulnerability

A vulnerability exists in GitLab CE/EE versions 17.2 prior to 17.11.5, 18.0 prior to 18.0.3, and 18.1 prior to 18.1.1. This issue could have allowed authenticated users with Guest role permissions to circumvent UI-enforced role restrictions and add child items to incident work items by sending specially crafted API requests.

Impact

Exploitation of this vulnerability could lead to unauthorized modifications of incident work items by users with Guest role permissions.

Added: Sep 1, 2025, 7:22 PM
Updated: Sep 1, 2025, 7:22 PM

Vulnerability Rating

Custom Algorithm
spread
7.3
impact
0.6
exploitability
5.2
remediation
0.0
relevance
0.2
threat
0.0
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.