GitLab Community Edition and Enterprise Edition contain a vulnerability that allows an authenticated user with minimal workspace permissions to bypass authorization checks and retrieve Jira Connect installation credentials. The attacker can then use those credentials to impersonate the GitLab application, effectively executing actions on behalf of the app. This permits unauthorized access to resources and data that should be protected, leading to potential compromise of confidentiality, integrity, and availability.

The flaw impacts all GitLab versions from 14.3 up to, but not including, 18.8.7, and all 18.9.x releases prior to 18.9.3, as well as all 18.10.x releases before 18.10.1. Both Community and Enterprise editions are affected. The issue is resolved in the listed patched releases.

The vulnerability carries a CVSS score of 8.1, indicating high severity. Exploitation requires authenticated access with workspace permissions, so an attacker must first obtain valid credentials. No exploit probability was provided, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Until the patch is applied, the risk remains high for systems that handle sensitive data.