CVE-2024-5318

What it actually does

Authorization bypass allowing guest users to retrieve dependency lists of private projects by accessing job artifacts.

Why it matters to the business

Organizations using GitLab may leak sensitive dependency information from private projects to unauthorized low-privilege users, increasing risk of supply-chain reconnaissance without requiring elevated access.

How an attack unfolds

An attacker with guest access to a private project requests or downloads job artifacts that contain dependency lists, bypassing intended authorization controls that should restrict such data to higher-privileged roles.

How to fix it

Upgrade GitLab CE/EE to 16.10.6, 16.11.3, or 17.0.1 or later; the fix is included in commit d134e2329e12dc93e72a8c3ed2744f75ef7a7e81.

How to confirm the fix worked

Confirm the running GitLab version is at or above the fixed releases, then attempt to access dependency lists as a guest user to verify the data is no longer returned.

Typical attack path

1. Obtain guest membership in a private GitLab project
2. Trigger or locate existing CI/CD jobs that produce artifacts
3. Access the job artifacts endpoint or download mechanism
4. Extract and view the dependency list data intended to remain private

How to detect it

Review GitLab access logs and artifact download events for guest-role users retrieving dependency-related artifacts; correlate with project membership changes.

What your security team should do

• Prioritize upgrade of all GitLab instances to the fixed versions within standard change windows
• Audit guest user access to private projects and limit artifact visibility where possible
• Review CI/CD job artifact contents to ensure no unnecessary sensitive data is stored