GitLab EE Group Memberships Business Logic Error Vulnerability

A business logic error vulnerability has been identified in GitLab Enterprise Edition (EE) versions 18.4 prior to 18.4.3 and 18.5 prior to 18.5.1. Under certain conditions, this vulnerability could have allowed authenticated users to gain unauthorized access to projects by exploiting the access request approval workflow.

Impact

Exploitation of this vulnerability could have led to unauthorized project access for authenticated users.

Remediation

GitLab has released patch versions 18.5.1, 18.4.3, and 18.3.5. It is strongly recommended that all self-managed GitLab installations be upgraded to one of these versions immediately.