GitLab EE Improper Access Control Vulnerability in Environments API

A vulnerability exists in GitLab EE versions 11.3 prior to 18.8.9, 18.9 prior to 18.9.5, and 18.10 prior to 18.10.3, allowing authenticated users with developer-role permissions to modify protected environment settings. This issue stems from inadequate authorization checks in the API.

Impact

Exploitation of this vulnerability could lead to unauthorized modifications of protected environment settings, potentially disrupting deployment processes or environment configurations.

Remediation

Users are advised to upgrade to GitLab versions 18.10.3, 18.9.5, or 18.8.9. Instructions for updating GitLab can be found in the GitLab Update documentation. Note that the SLES 12.5 packages for 18.10.3 and 18.9.5 are not available.