CVE-2024-12431

What it actually does

The flaw permits unauthorized users to alter issue statuses in public projects due to insufficient authorization checks on status modification endpoints.

Why it matters to the business

Attackers can tamper with project issue tracking without authentication, leading to inaccurate status reporting, disrupted workflows, and potential loss of trust in project management data across affected GitLab instances.

How an attack unfolds

An unauthenticated attacker identifies a public GitLab project, locates an issue, and sends crafted requests to the status update API or UI endpoints that bypass permission validation, successfully changing the issue status.

How to fix it

Upgrade GitLab CE/EE to 17.5.5 or later, 17.6.3 or later, or 17.7.1 or later. Apply the corresponding fixed kernel packages for any listed Ubuntu distributions where applicable.

How to confirm the fix worked

Confirm the running GitLab version is at or above the fixed releases listed in the advisory; test that unauthenticated users cannot modify issue status via API or UI in public projects.

Typical attack path

1. Discover a public GitLab project with issues
2. Identify the issue identifier and status field
3. Craft and send unauthorized status modification requests to vulnerable endpoints
4. Observe successful status change without authentication

How to detect it

Inspect GitLab application logs and audit events for status change operations performed by unauthenticated or unexpected users; correlate with project visibility settings.

What your security team should do

• Prioritize upgrade of all GitLab instances to the fixed versions immediately
• Review public projects for any anomalous issue status changes in audit logs
• Monitor EPSS and KEV status for changes in exploit likelihood