An issue has been discovered in GitLab CE/EE affecting all versions from 12.0 before 17.9.8, 17.10 before 17.10.6, and 17.11 before 17.11.2. Under certain conditions users could bypass IP access restrictions and view sensitive information.
Solution:
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.
| Link | Tags |
|---|---|
| https://gitlab.com/gitlab-org/gitlab/-/issues/519580 | issue tracking permissions required |
| https://hackerone.com/reports/2977149 | exploit permissions required technical description |