Volerion logoVolerion
Volerion logoVolerion

GitLab Improper Access Control Vulnerability in GraphQL API for Self-Hosted AI Models

Vulnerability

A vulnerability exists in GitLab Enterprise Edition (EE) versions 18.5 prior to 18.8.7, 18.9 prior to 18.9.3, and 18.10 prior to 18.10.1. This vulnerability allows an unauthenticated user to access API tokens of self-hosted AI models due to improper access control. The issue has been addressed in the latest patch releases.

Impact

Exploitation of this vulnerability could lead to unauthorized access to API tokens for self-hosted AI models, potentially allowing misuse of those tokens.

Remediation

Users are advised to upgrade to GitLab EE versions 18.10.1, 18.9.3, or 18.8.7. Instructions for updating GitLab can be found on the GitLab Update page.

Added: Mar 25, 2026, 9:42 PM
Updated: Mar 25, 2026, 9:42 PM

Vulnerability Rating

Custom Algorithm
spread
7.3
impact
2.5
exploitability
7.0
remediation
7.7
relevance
4.7
threat
0.0
urgency
2.9
incentive
4.2

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.