GitLab CE/EE Missing Authorization Vulnerability in Manual CI/CD Jobs

A missing authorization vulnerability has been identified in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 13.7 to 18.2.8, 18.3 prior to 18.3.4, and 18.4 prior to 18.4.2. This vulnerability could have allowed authenticated users without project membership to access sensitive manual CI/CD variables by querying the GraphQL API.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive manual CI/CD variables.

Remediation

Users are advised to upgrade to GitLab versions 18.4.2, 18.3.4, or 18.2.8. Instructions for updating GitLab can be found on the GitLab Update page. GitLab.com is already running the patched version.