An improper input validation vulnerability in GitLab CE/EE allows unauthenticated attackers to access sensitive tokens within the Storybook development environment.

The vulnerability is an improper neutralization of input during web page generation (CWE-79), specifically occurring in the Storybook development environment. This flaw permits an unauthenticated user to access sensitive tokens due to insufficient input validation.

The exposure of tokens within a development environment can lead to unauthorized access to downstream systems, API integrations, or further internal resources. Given the CVSS score of 8.0, this represents a high-severity risk that could result in significant data compromise or lateral movement within the development pipeline.

Immediate Action: Upgrade all instances of GitLab CE/EE to versions 18.9.6, 18.10.4, 18.11.1, or above immediately.

Proactive Monitoring: Review web server and application access logs for unusual requests targeting the Storybook endpoint or unexpected token usage patterns.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter malicious input strings and restrict access to development-specific endpoints such as Storybook from untrusted networks.

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the security researcher's report on HackerOne.

This vulnerability presents a clear risk to sensitive token security and must be addressed with high priority. Organizations should verify their current GitLab version and apply the recommended security updates to all affected environments, including development and staging instances, to prevent unauthorized access.