GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed a developer user to perform actions in the context of another users merge request commit due to a race condition issue in pipeline creation.
Weakness
The product checks the state of a resource before using that resource, but the resource’s state can change between the check and the use in a way that invalidates the results of the check.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Gitlab | Gitlab | 13.0.0 (including) | 19.1.8 (excluding) |
| Gitlab | Gitlab | 19.2.0 (including) | 19.2.6 (excluding) |
| Gitlab | Gitlab | 19.3.0 (including) | 19.3.2 (excluding) |