High · published December 11, 2025
⚡ An authenticated user can exploit a flaw in GitLab to craft wiki pages that perform unwanted actions on behalf of others! Think of GitLab as a collaborative kitchen where everyone can add their own recipes. If someone were to sneak in a recipe that looks delicious but has hidden ingredients that spoil the meal, it could ruin the whole dinner party! Imagine a user setting up misleading wiki pages that not only distort information but can also lead to unauthorized actions taken under someone else's name. This could jeopardize project integrity, damage reputations, and create confusion among collaborators. Absolutely devastating for teamwork!
Think of GitLab as a collaborative kitchen where everyone can add their own recipes. If someone were to sneak in a recipe that looks delicious but has hidden ingredients that spoil the meal, it could ruin the whole dinner party! This vulnerability allows authenticated users to create malicious wiki pages, which can trigger unauthorized actions under the guise of another user. The flaw impacts GitLab versions 18.4 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2.
Imagine a user setting up misleading wiki pages that not only distort information but can also lead to unauthorized actions taken under someone else's name. This could jeopardize project integrity, damage reputations, and create confusion among collaborators. Absolutely devastating for teamwork! Update your GitLab instance to versions 18.4.6, 18.5.4, or 18.6.2 immediately to close off this exploit. Regularly review user permissions and consider enabling stricter wiki page controls to prevent future issues! You've got this! By taking these steps, you'll ensure your GitLab environment is safe and sound! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| gitlab/gitlab | ≥ 18.4.0, < 18.4.6 | 18.4.6 |
| gitlab/gitlab | ≥ 18.4.0, < 18.4.6 | 18.4.6 |
| gitlab/gitlab | ≥ 18.5.0, < 18.5.4 | 18.5.4 |
| gitlab/gitlab | ≥ 18.5.0, < 18.5.4 | 18.5.4 |
| gitlab/gitlab | ≥ 18.6.0, < 18.6.2 | 18.6.2 |
| gitlab/gitlab | ≥ 18.6.0, < 18.6.2 | 18.6.2 |