CyberRota Analysis
AI-GeneratedGitLab versions prior to 19.1.8, 19.2.6, and 19.3.2 are vulnerable to a flaw that allows authenticated users with developer permissions to execute policy test pipelines, potentially exposing protected CI/CD variables meant for higher-privileged roles. This vulnerability arises from inadequate scope validation, which could lead to unauthorized access to sensitive information within projects. Organizations using affected versions should prioritize remediation to mitigate the risk of privilege escalation and data exposure.
Original NVD Description
GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions could have allowed an authenticated user with developer permissions to execute a policy test pipeline on projects within their group and access protected CI/CD variables restricted to higher-privileged roles, due to insufficient scope validation.
Related CVEs
Other vulnerabilities affecting the same vendor(s)