An issue has been discovered in GitLab CE/EE affecting all versions from 15.6 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that under certain conditions could have allowed authenticated users to bypass access controls and download private artifacts by accessing specific API endpoints.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://gitlab.com/gitlab-org/gitlab/-/issues/500134 | Broken Link |
| https://hackerone.com/reports/2780353 | Permissions Required |
Configurations
Configuration 1 (hide)
|
History
14 Aug 2025, 17:53
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* |
|
| First Time |
Gitlab gitlab
Gitlab |
|
| References | () https://gitlab.com/gitlab-org/gitlab/-/issues/500134 - Broken Link | |
| References | () https://hackerone.com/reports/2780353 - Permissions Required |
13 Aug 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-08-13 18:15
Updated : 2025-08-14 17:53
NVD link : CVE-2024-10219
Mitre link : CVE-2024-10219
JSON object : View
Products Affected
gitlab
- gitlab
CWE
CWE-863
Incorrect Authorization