An issue has been discovered in GitLab EE affecting all versions from 17.0 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that, under certain circumstances, could have allowed an attacker to access internal notes in GitLab Duo responses.
Solution:
The product's intended functionality exposes information to certain actors in accordance with the developer's security policy, but this information is regarded as sensitive according to the intended security policies of other stakeholders such as the product's administrator, users, or others whose information is being processed.
| Link | Tags |
|---|---|
| https://gitlab.com/gitlab-org/gitlab/-/issues/543905 | issue tracking permissions required broken link |
| https://hackerone.com/reports/3149956 | exploit permissions required technical description |