Loading vulnerability…
Privilege Escalation via Emoji on Confidential Work Items in GitLab
In GitLab versions 12.1 before 16.4.3, 16.5 before 16.5.3, and 16.6 before 16.6.1, a flaw allowed Guest users to add emoji reactions to confidential work items. This action should be restricted to users with higher privileges, as confidential work items are intended to be accessible only to authorized users.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
This vulnerability allows Guest users to interact with confidential work items in a limited way (adding emoji reactions), which could potentially leak the existence of confidential items or be used as a side channel for information disclosure or signaling. However, it does not grant access to the content of the confidential work items.
If you can’t patch tonight, do this now.
Restrict Guest user access to projects containing confidential work items until the patch can be applied. Monitor for unauthorized emoji reactions on confidential items as a potential indicator of exploitation.
Patch, then assume compromise.
Upgrade GitLab to version 16.4.3, 16.5.3, 16.6.1 or later, where the issue has been resolved and Guest users are properly restricted from interacting with confidential work items.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.