Medium severity6.5NVD Advisory· Published Aug 13, 2025· Updated Jun 17, 2026
CVE-2024-10219
CVE-2024-10219
Description
An issue has been discovered in GitLab CE/EE affecting all versions from 15.6 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that under certain conditions could have allowed authenticated users to bypass access controls and download private artifacts by accessing specific API endpoints.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
24cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*range: 15.6
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*range: >=15.6.0,<18.0.6
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*range: >=15.6.0,<18.0.6
- (no CPE)range: from 15.6 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2
- osv-coords19 versionspkg:bitnami/gitlabpkg:apk/chainguard/gitlab-runner-fips-18.2pkg:apk/chainguard/gitlab-docker-machine-fips-18.2pkg:apk/chainguard/gitlab-runner-helper-compat-fips-18.2pkg:apk/chainguard/gitlab-runner-helper-fips-18.2pkg:apk/chainguard/gitlab-runner-helper-oci-entrypoint-fips-18.2pkg:apk/chainguard/gitlab-runner-oci-entrypoint-fips-18.2pkg:apk/chainguard/gitlab-docker-machine-18.2pkg:apk/chainguard/gitlab-runner-18.2pkg:apk/chainguard/gitlab-runner-helper-18.2pkg:apk/chainguard/gitlab-runner-helper-compat-18.2pkg:apk/chainguard/gitlab-runner-helper-oci-entrypoint-18.2pkg:apk/chainguard/gitlab-runner-oci-entrypoint-18.2pkg:apk/wolfi/gitlab-docker-machine-18.2pkg:apk/wolfi/gitlab-runner-18.2pkg:apk/wolfi/gitlab-runner-helper-18.2pkg:apk/wolfi/gitlab-runner-helper-compat-18.2pkg:apk/wolfi/gitlab-runner-helper-oci-entrypoint-18.2pkg:apk/wolfi/gitlab-runner-oci-entrypoint-18.2
>= 15.6.0, < 18.0.6+ 18 more
- (no CPE)range: >= 15.6.0, < 18.0.6
- (no CPE)range: < 18.2.2-r0
- (no CPE)range: < 18.2.2-r0
- (no CPE)range: < 18.2.2-r0
- (no CPE)range: < 18.2.2-r0
- (no CPE)range: < 18.2.2-r0
- (no CPE)range: < 18.2.2-r0
- (no CPE)range: < 18.2.2-r0
- (no CPE)range: < 18.2.2-r0
- (no CPE)range: < 18.2.2-r0
- (no CPE)range: < 18.2.2-r0
- (no CPE)range: < 18.2.2-r0
- (no CPE)range: < 18.2.2-r0
- (no CPE)range: < 18.2.2-r0
- (no CPE)range: < 18.2.2-r0
- (no CPE)range: < 18.2.2-r0
- (no CPE)range: < 18.2.2-r0
- (no CPE)range: < 18.2.2-r0
- (no CPE)range: < 18.2.2-r0
- Range: from 15.6 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2
Patches
Vulnerability mechanics
References
2- gitlab.com/gitlab-org/gitlab/-/issues/500134nvdBroken Link
- hackerone.com/reports/2780353nvdPermissions Required
News mentions
1- GitLab Patch Release: 18.2.2, 18.1.4, 18.0.6GitLab Security Releases · Aug 13, 2025