GitLab Improper Access Control Vulnerability in GitLab Pages

A vulnerability exists in GitLab CE/EE versions 17.9 prior to 18.3.6, 18.4 prior to 18.4.4, and 18.5 prior to 18.5.2, allowing authenticated users to bypass access controls and access GitLab Pages content meant for project members. This issue arises from OAuth authentication, which can be exploited to view restricted content.

Impact

Exploitation of this vulnerability could lead to unauthorized access to GitLab Pages content, allowing users to view information intended only for specific project members.

Remediation

Users are advised to upgrade to GitLab versions 18.5.2, 18.4.4, or 18.3.6. Instructions for updating GitLab can be found on the GitLab Update page. For GitLab Runner, refer to the Updating the Runner page.