Loading vulnerability…
Unauthorized Release Description Disclosure in GitLab Atom Endpoint
A vulnerability in GitLab (versions 11.3 to 16.4.2, 16.5 to 16.5.2, and 16.6 to 16.6.0) allows unauthorized users to access release descriptions of public projects via a specific atom endpoint, even when release access is restricted to project members. The flaw is due to improper access control on the atom feed endpoint for release descriptions.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Unauthorized users can view sensitive release information in public projects, potentially exposing confidential details about releases that should only be visible to project members. This could lead to information leakage and facilitate targeted attacks based on disclosed release data.
If you can’t patch tonight, do this now.
As a temporary mitigation, restrict access to the affected atom endpoint via network controls or web application firewall rules until the instance can be upgraded to a fixed version.
Patch, then assume compromise.
Upgrade GitLab to version 16.4.3, 16.5.3, or 16.6.1 or later, where the access control issue on the atom endpoint has been resolved.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.