REDHAT-BUG-2452920: High severity GitLab GitLab CE/EE vulnerability
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 affecting Jira Connect installations that could have allowed an authenticated user with minimal workspace permissions to obtain installation credentials and impersonate the GitLab app due to improper authorization checks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 18.8.7 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 18.9.3 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 18.10.1
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2452920?
The severity of REDHAT-BUG-2452920 is classified as high with a score of 7.
How do I fix REDHAT-BUG-2452920?
To fix REDHAT-BUG-2452920, upgrade GitLab CE/EE to version 18.8.7 or newer, 18.9.3 or newer, or 18.10.1 or newer.
What versions of GitLab are affected by REDHAT-BUG-2452920?
REDHAT-BUG-2452920 affects all GitLab versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1.
What kind of issue is REDHAT-BUG-2452920?
REDHAT-BUG-2452920 is a vulnerability in GitLab that could allow authenticated users with minimal permissions to obtain installation credentials.
When was REDHAT-BUG-2452920 published?
REDHAT-BUG-2452920 was published on March 30, 2026.