CVE-2024-8116

What it actually does

The flaw permits an unauthenticated user to craft a specific GraphQL query that bypasses authorization checks and returns branch names from repositories under certain conditions.

Why it matters to the business

Organizations running affected GitLab instances face exposure of internal branch naming conventions and repository structure, which can aid reconnaissance and increase risk of targeted follow-on attacks; the large number of downstream dependents amplifies the need for prompt patching.

How an attack unfolds

An attacker sends a crafted GraphQL query to a vulnerable GitLab instance; under specific conditions the authorization logic fails to enforce access controls, allowing the response to include branch names that should be restricted.

How to fix it

Upgrade GitLab CE/EE to 17.4.6, 17.5.4, or 17.6.2 (or later) which contain the fix commit 25a55583bbcf724ad625848d48a529467e7c7097; apply the update as soon as possible given the published remediation deadline context.

How to confirm the fix worked

Confirm the installed GitLab version is at or above the fixed releases; attempt the previously successful GraphQL query and verify that branch names are no longer returned to unauthorized users.

Typical attack path

1. Identify a reachable GitLab instance running an affected version
2. Craft and send a specific GraphQL query targeting branch information
3. Receive unauthorized branch name data in the response
4. Use disclosed branch names to map repository structure for further attacks

How to detect it

Search GitLab application and GraphQL access logs for queries that request branch names without corresponding authentication or project membership tokens; look for repeated or anomalous GraphQL operations around the publication date.

What your security team should do

• Immediately schedule upgrades to the fixed versions 17.4.6 / 17.5.4 / 17.6.2
• Review GraphQL access logs for unusual queries requesting branch data
• Limit public or unauthenticated access to repository metadata where feasible
• Monitor EPSS trend and re-evaluate exploit maturity as new information emerges