A critical race condition in GitLab CE/EE could allow an authenticated user to impersonate higher-privileged accounts, posing a severe risk to organizational data integrity.

The vulnerability is a Time-of-check Time-of-use (TOCTOU) race condition that allows an authenticated user to intercept or obtain credentials belonging to higher-privileged accounts. Under specific conditions, this enables the attacker to perform actions within the context of the compromised high-privilege user.

Successful exploitation allows an attacker to gain unauthorized access to sensitive repositories, configurations, or administrative functions by hijacking a privileged session. Given the CVSS score of 7.7, this represents a high-severity risk that could lead to full account takeover and significant data compromise within the development environment.

Immediate Action: Administrators must upgrade GitLab CE/EE instances to versions 18.4.5, 18.5.3, 18.6.1, or above immediately to apply the necessary security patches.

Proactive Monitoring: Security teams should monitor audit logs for unusual account activity, specifically looking for actions performed by privileged users from unexpected IP addresses or at anomalous times.

Compensating Controls: While a WAF may provide limited protection against race conditions, ensuring that strict session management and multi-factor authentication are enforced for all administrative accounts can reduce the likelihood of successful abuse.

Public Exploit Available: Yes (a published PoC exists, attributed to the HackerOne report linked in the CVE record).

This vulnerability presents a significant risk to the security of the software development lifecycle. Organizations utilizing affected versions of GitLab should prioritize the identified patch release to prevent potential credential theft and unauthorized administrative actions. Given the availability of a proof-of-concept, prompt patching is essential to maintain the integrity of the CI/CD pipeline.