CVE-2024-8650 Overview
CVE-2024-8650 is an authorization vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw allows non-member users to view unresolved threads marked as internal notes within public project merge requests. Internal notes are intended to be visible only to project members, so this defect breaks the confidentiality boundary GitLab enforces around collaborator-only discussions. The issue is tracked under CWE-863: Incorrect Authorization and affects a wide version range across GitLab CE/EE deployments. GitLab addressed the flaw in versions 17.4.6, 17.5.4, and 17.6.2.
Critical Impact
Unauthenticated or non-member users can read internal notes in public merge request threads, disclosing information intended to be restricted to project members.
Affected Products
- GitLab CE/EE all versions from 15.0 prior to 17.4.6
- GitLab CE/EE 17.5 prior to 17.5.4
- GitLab CE/EE 17.6 prior to 17.6.2
Discovery Timeline
- 2024-12-16 - CVE-2024-8650 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-8650
Vulnerability Analysis
The vulnerability resides in GitLab's authorization logic for merge request discussion threads. GitLab supports internal notes, a feature that restricts a comment or thread to project members and elevated roles. In affected versions, the visibility check for unresolved threads containing internal notes did not correctly enforce membership. As a result, non-member users viewing a public project's merge request could observe threads that should have remained hidden. The exposure is limited to confidentiality; integrity and availability are not affected. The information disclosed may include triage discussions, security context, or sensitive review commentary that project maintainers assumed was private.
Root Cause
The root cause is an incorrect authorization check [CWE-863] applied to unresolved discussion threads in merge requests. The server-side permission model failed to filter internal notes when rendering thread state to users without project membership, treating the thread visibility independently of the note confidentiality attribute.
Attack Vector
Exploitation requires only network access to a GitLab instance that hosts a public project with active merge requests. An unauthenticated or non-member user browses the merge request and can view unresolved internal note threads that GitLab should have hidden. No user interaction from a victim is needed and no privileges are required on the target project. Further technical details are tracked in GitLab Issue #486300 and HackerOne Report #2705909.
No public proof-of-concept exploit code has been published for this issue. See the vendor advisory for details.
Detection Methods for CVE-2024-8650
Indicators of Compromise
- Access log entries showing unauthenticated or non-member accounts requesting merge request discussion endpoints on public projects.
- Elevated volumes of requests to /api/v4/projects/:id/merge_requests/:iid/discussions from external or unassociated user identifiers.
- Anomalous scraping patterns targeting public project merge requests across a self-managed GitLab instance.
Detection Strategies
- Audit GitLab application logs for repeated merge request discussion reads by users without project membership.
- Correlate API access patterns against known contributor lists to surface non-member reads of internal-note-bearing threads.
- Query the GitLab database for merge requests that contain unresolved internal notes and cross-reference their access history.
Monitoring Recommendations
- Forward GitLab production and API logs into a centralized SIEM for authorization anomaly correlation.
- Alert on spikes of anonymous access to public project merge request discussion APIs.
- Track the GitLab version deployed across self-managed instances and flag any host still running an unpatched release.
How to Mitigate CVE-2024-8650
Immediate Actions Required
- Upgrade self-managed GitLab CE/EE to 17.4.6, 17.5.4, or 17.6.2 or later as appropriate for your release branch.
- Inventory public projects that use internal notes on merge requests and review recent access logs for suspicious reads.
- Rotate or redact any secrets, credentials, or sensitive context that may have been disclosed through internal notes.
Patch Information
GitLab released fixed versions 17.4.6, 17.5.4, and 17.6.2 that enforce correct authorization on internal notes in merge request threads. GitLab.com SaaS instances are already running the patched code. Refer to GitLab Issue #486300 for the vendor-tracked remediation.
Workarounds
- Convert affected public projects to internal or private visibility until patching is complete.
- Remove or resolve unresolved internal note threads in public merge requests that contain sensitive information.
- Restrict anonymous access to the GitLab instance at the network layer where feasible.
# Verify installed GitLab version on a self-managed instance
sudo gitlab-rake gitlab:env:info | grep -i "GitLab information" -A 5
# Upgrade using the Omnibus package (Debian/Ubuntu example)
sudo apt-get update && sudo apt-get install gitlab-ee=17.6.2-ee.0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
