A critical authorization vulnerability in GitLab EE allows authenticated users to perform unauthorized modifications to vulnerability records, posing a significant risk to data integrity.

This is an incorrect authorization flaw (CWE-863) where incorrectly scoped GraphQL mutations enable authenticated users with restricted read-only API tokens to execute unauthorized write operations on vulnerability records.

The ability for low-privileged users to modify vulnerability records undermines the integrity of security management workflows and compliance reporting. With a CVSS score of 7.7, this vulnerability represents a high risk as it facilitates unauthorized data manipulation, potentially allowing attackers to suppress or alter critical security findings within the platform.

Immediate Action: Upgrade all GitLab EE instances to version 18.3.4, 18.4.2, or higher immediately to apply the necessary authorization logic fixes.

Proactive Monitoring: Review API access logs for unusual mutation activity or unauthorized write attempts originating from accounts typically restricted to read-only access.

Compensating Controls: Restrict API access to trusted networks and audit existing API tokens to ensure that only necessary users possess the permissions required for their roles until the patch is applied.

Public Exploit Available: No

Given the potential for unauthorized modification of security-critical data, organizations should prioritize patching GitLab EE to the specified secure versions. Failure to remediate this issue could lead to the degradation of security visibility and potential manipulation of vulnerability management records. Apply the vendor-supplied updates as part of the next maintenance cycle to ensure full protection against this authorization bypass.