“The vulnerability impacts all GitLab CE/EE versions from 15.8 through 16.11.4, 17.0.0 to 17.0.2, and 17.1.0 to 17.1.0.”
CVE-2024-5655 scores 9.6 out of 10 and lets an attacker trigger a pipeline as another user. GitLab has an estimated one million active license users. The hole spans every release since 15.8, and the same update fixed 13 other bugs. The CI system you trust to guard your builds was handing out other people’s identities.