CVE-2022-3413

Vulnerability

An incorrect authorization check in GitLab EE allows users with lower roles to view audit events of other members. The vulnerability affects all versions from 14.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. The bug is in the audit events UI, which permits filtering by author username via a query parameter without enforcing proper role-based restrictions. Developers can view project audit events, and Developers or Maintainers can view group audit events, which should be limited to Project Maintainers and Group Owners respectively [1].

Exploitation

An attacker must be logged in as a user with at least Developer role on the target project or Developer/Maintainer role on the target group. The attacker navigates to the audit events page for the group or project and appends ?entity_type=Author&author_username=<target_username> to the URL. This bypasses the intended access controls and displays the target user's audit events [1]. No additional privileges or user interaction beyond the initial login are required.

Impact

Successful exploitation results in unauthorized disclosure of audit events belonging to other users. These events may include sensitive actions such as project creation, import, approval rule changes, and other administrative activities. The attacker gains visibility into the activity of other members, violating confidentiality and potentially exposing privileged operations. The attacker does not obtain write access or remote code execution; the impact is limited to information disclosure [1].

Mitigation

GitLab has released fixed versions 15.3.5, 15.4.4, and 15.5.2 that correct the authorization logic. Users should upgrade to these versions or later. No workaround is available. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date [1].