GitLab EE: authenticated user can view restricted group configuration settings

Impact

Improper authorization checks on a group settings page let an authenticated user view configuration settings that should be restricted to higher-privileged roles. For a self-managed GitLab driving fleet CI/CD, group settings describe integrations, runner and compliance configuration - useful reconnaissance for an account already inside the instance, but the record describes viewing only. GitLab rates confidentiality low with no integrity or availability impact, and does not say which settings are exposed. Affects 17.7 before 19.0.6, 19.1 before 19.1.4 and 19.2 before 19.2.2.

Who can reach it

An authenticated GitLab user reaching the group settings page over the network. No elevated role is required beyond whatever access the group already grants.

What to do

Upgrade to 19.0.6, 19.1.4 or 19.2.2 per the GitLab 19.2.2 patch release - a package upgrade and service restart (Omnibus reconfigure/restart or a Helm chart bump), with a short GitLab outage and no fleet impact.

References