GitLab EE Compliance Framework Assignment Vulnerability

A vulnerability exists in GitLab EE versions 16.10 prior to 17.11.5, 18.0 prior to 18.0.3, and 18.1 prior to 18.1.1. This issue could have allowed authenticated users to improperly assign compliance frameworks to projects. The vulnerability arose from the ability to send manipulated GraphQL mutations that circumvented permission checks specific to the frameworks.

Impact

Exploitation of this vulnerability could lead to improper assignment of compliance frameworks, allowing users to assign unrelated frameworks to projects without the necessary permissions.