GitLab CE/EE Developer Role Vulnerability

CVE-2024-11931

Summary

A security issue has been identified in GitLab CE/EE that could potentially allow users with a developer role to extract sensitive protected CI variables through the CI lint feature. This vulnerability affects multiple versions of the software, specifically from 17.0 up to 17.6.4, from 17.7 up to 17.7.3, and from 17.8 up to 17.8.1. It highlights a significant risk for projects that rely on the confidentiality of their CI settings, emphasizing the need for immediate action to secure these variables against unauthorized access. The issue has raised concerns within the community, prompting discussions about optimal permission settings and the safeguarding of sensitive data.

References