GitLab EE Information Disclosure Vulnerability via GraphQL Queries

A vulnerability in GitLab Enterprise Edition (EE) has been addressed, affecting versions 16.6 prior to 18.8.9, 18.9 prior to 18.9.5, and 18.10 prior to 18.10.3. This vulnerability could have allowed an authenticated user to access other users' email addresses through specific GraphQL queries under certain circumstances.

Impact

Exploitation of this vulnerability could lead to unauthorized access to users' email addresses.

Remediation

Users are strongly advised to upgrade to GitLab versions 18.10.3, 18.9.5, or 18.8.9. Instructions for updating GitLab can be found on the GitLab Update page. Note that the SLES 12.5 packages for 18.10.3 and 18.9.5 are not present in this release.