GitLab CE/EE Improper Access Control Vulnerability in Merge Requests

A vulnerability exists in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 11.10 prior to 18.8.7, 18.9 prior to 18.9.3, and 18.10 prior to 18.10.1. This vulnerability allows authenticated users to perform unauthorized actions on merge requests in other projects. The issue arises from improper access control during cross-repository operations.

Impact

Exploitation of this vulnerability could lead to unauthorized modifications or actions on merge requests in projects where the user does not have permission to make such changes.

Remediation

Users are advised to upgrade to GitLab versions 18.10.1, 18.9.3, or 18.8.7. Instructions for updating GitLab can be found on the GitLab Update page. Note that this patch includes database migrations that may impact the upgrade process.