GitLab CE/EE Group Import Missing Authorization Vulnerability Allows Label Creation in Private Projects

A missing authorization vulnerability has been identified in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 14.4 prior to 18.7.6, 18.8 prior to 18.8.6, and 18.9 prior to 18.9.2. This vulnerability could have allowed an authenticated user with group import permissions to create labels in private projects. The issue arises from improper authorization validation in the group import process under certain circumstances.

Impact

Exploitation of this vulnerability could lead to unauthorized label creation in private projects, potentially allowing for manipulation of project organization or workflow.

Remediation

GitLab has released patch versions 18.9.2, 18.8.6, and 18.7.6. Instructions for updating GitLab can be found on the GitLab Update page. After updating, it's important to verify that the application is running the patched version.