CVE-2023-3102
Description
A sensitive information leak issue has been discovered in GitLab EE affecting all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows access to titles of private issue and MR.
Summary dbcve.org
This is an information disclosure vulnerability in GitLab EE where improper authorization allows authenticated users to view titles of private issues and merge requests they should not have access to. The vulnerability stems from insufficient access control checks in the API or web interface that expose sensitive title metadata despite the content being properly protected.
Mitigation
Upgrade GitLab EE to version 16.0.6 or later, or 16.1.1 or later, to patch the authorization bypass. Verify after upgrade that private issue/MR titles are not visible to unauthorized users.