GitLab CE/EE Information Disclosure Vulnerability in Access Control Allows Viewing Confidential Branch Names

A vulnerability exists in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 17.6 prior to 18.3.6, 18.4 prior to 18.4.4, and 18.5 prior to 18.5.2. Under certain conditions, this vulnerability could have allowed unauthorized users to view confidential branch names by accessing project issues related to those branches through merge requests.

Impact

Exploitation of this vulnerability could lead to unauthorized access to confidential branch names, potentially allowing users to view sensitive information or code that is not meant for public visibility.

Remediation

Users are advised to upgrade to GitLab versions 18.5.2, 18.4.4, or 18.3.6. Instructions for updating GitLab can be found on the GitLab Update page. For GitLab Runner, see the Updating the Runner page.