SAML Configuration Flaw in GitLab CE/EE Leading to Unauthorized Access

CVE-2024-13041

Summary

A vulnerability exists in GitLab CE/EE that affects all versions starting from 16.4 prior to 17.5.5, 17.6 prior to 17.6.3, and 17.7 prior to 17.7.1. This flaw occurs when users are created through a SAML provider, where the 'external groups' setting may override the intended external provider configuration. Consequently, users may not be designated as external, inadvertently granting them access to internal projects and groups, thus compromising access controls.

References