GitLab’s Community and Enterprise editions contain a flaw that permits an authenticated user to trigger unintended server‑side methods through websocket connections. The improper access control allows these users to invoke functions that should not be available to them, leading to unauthorized execution of privileged actions. This weakness is classified as CWE‑749, describing a dangerous method that was exposed.

All GitLab Community and Enterprise edition releases from 16.9.6 up to 18.8.8, from 18.9.0 through 18.9.4, and from 18.10.0 through 18.10.2 are affected. The recommended fix applies to 18.8.9, 18.9.5, 18.10.3, and later versions.

The CVSS score of 8.5 indicates a high severity risk. The vulnerability requires the attacker to be authenticated and to send crafted websocket frames to the GitLab server. The attack vector is inferred to be the websocket protocol, as the description references websocket connections. While specific exploit probabilities are not publicly available, the high CVSS score and potential for unauthorized method execution make remediation urgent.