CVE-2024-5005

What it actually does

Authorization bypass that permits guest users to retrieve project templates through the API, exposing content that should be restricted by role-based access controls.

Why it matters to the business

Unauthorized disclosure of internal project structures and starter code can leak intellectual property, reduce competitive advantage, and increase the attack surface for further reconnaissance against the organization.

How an attack unfolds

An attacker obtains guest-level access to a GitLab instance, issues crafted API requests targeting the project templates endpoint, and receives template data that bypasses intended permission checks.

How to fix it

Upgrade GitLab EE/CE to 17.2.9, 17.3.5, or 17.4.2 (or later) depending on the installed branch; apply the commit 91146650fd2d7d080662a536b1d04a5c96f451be where direct patching is required.

How to confirm the fix worked

Confirm the running GitLab version matches or exceeds a fixed release, then attempt to access project templates via the API with a guest account to verify that requests are now denied.

Typical attack path

1. Obtain guest user account or token on the target GitLab instance
2. Identify the project templates API endpoint through documentation or enumeration
3. Send authenticated API requests to the templates endpoint without higher privileges
4. Receive and exfiltrate template contents that should have been inaccessible

How to detect it

Review GitLab API access logs for requests to the project templates endpoint originating from accounts with only guest membership; correlate with authentication events showing low-privilege tokens.

What your security team should do

• Immediately schedule the version upgrade within the next maintenance window due to the long disclosure window
• Audit guest user accounts and API tokens for necessity
• Enable API request logging and monitor for anomalous template access patterns
• Review downstream dependent projects that consume GitLab templates for additional exposure