GitLab EE Incorrect Authorization Vulnerability in Authorization Caching

A vulnerability has been identified in GitLab Enterprise Edition (EE) versions 18.1 prior to 18.8.7, 18.9 prior to 18.9.3, and 18.10 prior to 18.10.1. This vulnerability could have allowed an authenticated user to gain unauthorized access to resources by exploiting improper caching of authorization decisions.

Impact

Exploitation of this vulnerability could lead to unauthorized access to resources, allowing users to access or manipulate data or functionalities they should not have permission to.

Remediation

Users are strongly advised to upgrade to GitLab EE versions 18.10.1, 18.9.3, or 18.8.7. Instructions for updating GitLab can be found on the GitLab Update page. Note that the SLES 12.5 package is not available for GitLab 18.10.1.