CVE-2023-4018: 
GitLab vulnerability analysis and mitigation

An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.5 and all versions starting from 16.3 before 16.3.1. Due to improper permission validation, it was possible to create model experiments in public projects. The vulnerability was discovered and reported through GitLab's HackerOne bug bounty program by researcher ricardobrito (GitLab Security Release).

The vulnerability stems from improper permission validation in GitLab's machine learning experiment tracking feature. The API endpoints related to MLFlow experiments did not properly verify whether users had appropriate project membership permissions. The issue has been assigned a CVSS v3.1 base score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (NVD).

The vulnerability allows unauthorized users to create and manipulate machine learning experiments in public projects without having proper project membership. This could lead to unauthorized data manipulation and potential disruption of legitimate machine learning experiment tracking (GitLab Issue).

The vulnerability has been fixed in GitLab versions 16.2.5 and 16.3.1. Users are strongly recommended to upgrade to these patched versions immediately. GitLab.com has already been updated with the patched version (GitLab Security Release).