A critical authorization vulnerability in GitLab EE allows authenticated attackers to hijack project runners, potentially leading to unauthorized code execution and data compromise.

This issue is a missing authorization flaw (CWE-862) that enables an authenticated attacker possessing specific project permissions to perform unauthorized actions on runners belonging to other projects. The vulnerability requires the attacker to be authenticated, but it permits them to bypass intended scope restrictions to hijack runners.

The ability to hijack project runners poses a severe risk to the software supply chain and internal development security. An attacker could potentially inject malicious code into CI/CD pipelines, exfiltrate sensitive environment variables, or access proprietary source code, leading to significant reputational damage and data loss. With a CVSS score of 8.5, this high-severity flaw requires immediate attention to prevent unauthorized lateral movement within the development environment.

Immediate Action: Upgrade all GitLab EE instances to version 18.3.5, 18.4.3, 18.5.1, or above to resolve the authorization logic error.

Proactive Monitoring: Review CI/CD pipeline logs for unexpected runner registration requests or modifications to runner configurations by unauthorized project members.

Compensating Controls: Restrict the ability of non-administrative users to manage runner configurations until patching is completed, and enforce strict access controls on project settings.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the HackerOne report linked in the CVE references.

Given the potential for unauthorized code execution and pipeline manipulation, this vulnerability should be prioritized for immediate remediation. Organizations must verify their current GitLab EE version and apply the recommended patches without delay to secure their CI/CD infrastructure against potential hijack attempts.