An issue has been discovered in GitLab CE/EE affecting all versions from 17.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could have allowed an authenticated user to gain unauthorized access to confidential issues by creating a project with an identical name to the victims project.
Weakness
The product assigns an owner to a resource, but the owner is outside of the intended control sphere.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Gitlab | Gitlab | 17.10.0 (including) | 18.2.7 (excluding) |
| Gitlab | Gitlab | 18.3.0 (including) | 18.3.3 (excluding) |
| Gitlab | Gitlab | 18.4.0 (including) | 18.4.0 (including) |