CVE-2024-8631: 
GitLab vulnerability analysis and mitigation

A privilege escalation vulnerability (CVE-2024-8631) was discovered in GitLab Enterprise Edition (EE) affecting versions from 16.6 to 17.3.2 (specifically prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2). The vulnerability allows users with the Admin Group Member custom role to escalate their privileges to include other custom roles (GitLab Release, NVD).

The vulnerability stems from a misconfiguration in the custom roles feature where users with the Admin Group Member custom role could manipulate their role assignments. The issue has been assigned a CVSS v3.1 base score of 7.2 (HIGH) by NVD and 5.5 (MEDIUM) by GitLab Inc. The vulnerability is classified under CWE-267 (Privilege Defined With Unsafe Actions) (NVD).

If exploited, this vulnerability allows an attacker with Admin Group Member custom role to gain unauthorized access to additional custom role permissions, potentially leading to elevated privileges within the GitLab instance (GitLab Release).

The vulnerability has been fixed in GitLab versions 17.1.7, 17.2.5, and 17.3.2. Users are strongly recommended to upgrade to these patched versions immediately. GitLab.com has already been updated with the fix (GitLab Release).