GitLab experienced an authentication bypass flaw that could let users holding a Developer role modify protected Conan packages without proper authorization. The defect originates from the handling of alternate paths or channels that bypass normal permission checks. If exploited, it would allow a non-admin user to alter package metadata or contents, potentially compromising downstream users and systems that rely on those packages.

The vulnerability affects GitLab Enterprise Edition and Community Edition across all major releases starting with 17.11 up to before 18.7.5, from 18.8 before 18.8.5, and from 18.9 before 18.9.1. Restoring to any of the patched releases – 18.7.5, 18.8.5, 18.9.1 or later – eliminates the weakness.

The CVSS v3.1 base score is 4.3, placing the issue in the moderate range. EPSS indicates the exploitation probability is below 1 %. The flaw is not currently listed in the CISA KEV catalog. Exploitation would require an attacker to be a Developer‑role user on a vulnerable instance and to access the vulnerable package management interface or API path that triggers the bypass. No additional host, network, or local prerequisites are required beyond legitimate user credentials.