GitLab’s authentication system contains an improper authorization check that allows an authenticated user with only minimal workspace permissions in a Jira Connect integration to retrieve the installation credentials for the GitLab application. By obtaining these credentials, the attacker can impersonate GitLab, effectively acting as the application itself. This unauthorized impersonation enables the user to access sensitive configuration data and perform actions that should be restricted to authorized administrators, thereby compromising the integrity and confidentiality of the integrated environment.

GitLab Community Edition and GitLab Enterprise Edition deployments from version 14.3 up through versions 18.8.6, 18.9.0 to 18.9.2, and the 18.10.0 release are affected when connected to Jira. The vulnerability does not apply to the patched releases 18.8.7, 18.9.3, or 18.10.1 and later.

The CVSS metric scores the flaw as 8.1, indicating high severity. The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, but the requirement for only an authenticated user with minimal workspace rights means that compromise can occur if an account is already trusted. Once exploited, an attacker can steal credentials and impersonate the GitLab application, potentially allowing further lateral movement or unauthorized configuration changes.