Database/Control plane, storage & DevOps
GitLab EE: authenticated user executes unauthorized quick actions via crafted descriptions
Impact
An authenticated GitLab EE user can smuggle quick-action commands into certain description fields and have them executed outside their own authorization, which the record scores as high confidentiality and integrity impact. For a datacenter that runs self-hosted GitLab as the CI/CD and GitOps front door to its fleet, the concern is project and issue state being changed by someone who should not be able to change it - assignments, confidentiality, labels that gate automation. The record does not describe any path to the runners or to the hosts they run on, so treat this as a control-plane authorization bug, not pipeline RCE.
Who can reach it
Network, authenticated with low privileges (PR:L) - any user who can write a description in an affected project. No administrator access needed.
What to do
Upgrade self-hosted GitLab EE to 18.3.5, 18.4.3 or 18.5.1 depending on your branch, per the 18.5.1 patch release. Standard GitLab upgrade and service restart; no GPU node impact. gitlab.com is already patched.
References
Related entries
- HPE Performance Cluster Manager (HPCM) GUI authentication bypass: Authentication bypass in the HPCM web GUICVE-2025-27086 · HPE Performance Cluster Manager (HPCM) GUI authentication bypassHigh
- HTCondor (IDToken authorization restrictions): The per-token authorization restrictions attached withCVE-2025-30093 · HTCondor (IDToken authorization restrictions)High
- ConnectWise ScreenConnect: ViewState code injectionCVE-2025-3935 · ConnectWise ScreenConnectHigh
- Coder: prebuilds system-user session token survives workspace claim and stays validCVE-2025-58437 · Coder (prebuilt workspace session token lifecycle)High
- MinIO (service accounts / STS session policies): The session policy attached to a service account or STS credential isCVE-2025-62506 · MinIO (service accounts / STS session policies)High
- Apache CloudStack: MinIO policies survive bucket deletion, giving a former owner access to a new bucket of the same nameCVE-2025-66467 · Apache CloudStack (MinIO object store policy cleanup on bucket deletion)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.