The Pakistan Telecommunication Authority (PTA) has issued a critical cybersecurity advisory for all GitLab users, urging immediate action. Multiple high-severity vulnerabilities have been found in GitLab Community Edition (CE) and Enterprise Edition (EE) that could put sensitive organizational data at serious risk.

What’s the Threat?

Two major vulnerabilities have been identified:

  • CVE-2023-3441: Inadequate warnings when users are given merge access to protected branches — opening the door for unauthorized code changes.
  • CVE-2024-5005: A serious flaw that allows authenticated users to expose sensitive project data through the GitLab API.

These bugs affect GitLab versions 8.0 to just before 17.4.2, meaning a wide range of installations are vulnerable.

Why It Matters

These are information disclosure vulnerabilities — meaning they could lead to:

  • Leaked templates and project data
  • Unauthorized access to protected code
  • Potential compromise of intellectual property
  • Operational and reputational damage

If you're using GitLab for software development or version control, these flaws could directly impact your workflow, security, and privacy.

What You Need to Do

PTA strongly recommends the following steps for all GitLab users:

Upgrade Immediately:

  • Install GitLab version 17.4.2 or later.
  • All security patches were officially released on October 9, 2024.

Strengthen Cyber Defenses:

  • Regularly update your systems.
  • Apply security patches promptly.
  • Limit user access based on roles.
  • Monitor access logs for suspicious behavior.

A Note from PTA

“Timely system updates and proactive security practices are essential for protecting organizational data in today’s digital landscape.”
– Pakistan Telecommunication Authority

Final Thoughts

In today’s hyper-connected world, a single vulnerability can lead to a massive breach. Don’t wait until it's too late. If your team relies on GitLab, now’s the time to act fast, patch up, and lock down your systems.