## Summary
GitLab CE/EE contains an issue (CWE-863) where improper input validation in an environment scope pattern matcher could allow an authenticated user to access CI/CD variables outside their intended environment scope. GitLab has remediated the issue in versions prior to 19.1.8, 19.2.6, and 19.3.2.
## Technical Details
The NVD description attributes the problem to improper input validation in the “environment scope pattern matcher,” which is used to determine whether a user’s CI/CD variable access request matches the intended environment scope. Under “certain conditions,” a crafted input could bypass the matcher’s intended constraints, enabling scope escape.
- Root cause class: CWE-863 (Incorrect Authorization)
- Affected logic: environment scope pattern matcher (input validation weakness)
- Preconditions: authenticated user
## Affected
- GitLab CE/EE versions: all versions from 15.7 before 19.1.8
- GitLab CE/EE versions: all versions from 19.2 before 19.2.6
- GitLab CE/EE versions: all versions from 19.3 before 19.3.2
## Impact
- Confidentiality impact: C:H (access CI/CD variables outside intended environment scope)
- Integrity and availability impact: I:N, A:N
- Attack vector: AV:N (network)
- Privileges required: PR:L (authenticated user with limited privileges)
## Mitigation
1. Upgrade GitLab CE/EE to a fixed release that is not in the affected ranges: >= 19.1.8, >= 19.2.6, or >= 19.3.2 (as applicable).
2. Review CI/CD variable usage and environment scope configurations for projects where authenticated users may have access to CI/CD settings.
3. Monitor for anomalous CI/CD variable access patterns that appear to reference variables from environments outside the user’s expected scope.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CWE-863