CVE-2018-20500

An insecure permissions issue was discovered in GitLab Community and Enterprise Edition 9.4 and later but before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. The runner registration token in the CI/CD settings could not be reset. This was a security risk if one of the maintainers leaves the group and they know the token.

• CWE-732

• https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/Release Notes, Vendor Advisory
• https://about.gitlab.com/blog/categories/releases/Release Notes, Vendor Advisory
• https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/Release Notes, Vendor Advisory
• https://about.gitlab.com/blog/categories/releases/Release Notes, Vendor Advisory

Published

May 17, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-20495An issue was discovered in GitLab Community and Enterprise E…5.3
• CVE-2018-20496An issue was discovered in GitLab Community and Enterprise E…5.4
• CVE-2018-20497An issue was discovered in GitLab Community and Enterprise E…5
• CVE-2018-20498An issue was discovered in GitLab Community and Enterprise E…4.3
• CVE-2018-20499An issue was discovered in GitLab Community and Enterprise E…7.2
• CVE-2018-2050Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-20501An issue was discovered in GitLab Community and Enterprise E…6.3
• CVE-2018-20502An issue was discovered in Bento4 1.5.1-627. There is an att…
• CVE-2018-20503Allied Telesis 8100L/8 devices allow XSS via the edit-ipv4_i…
• CVE-2018-20505SQLite 3.25.2, when queries are run on a table with a malfor…
• CVE-2018-20506SQLite before 3.25.3, when the FTS3 extension is enabled, en…
• CVE-2018-20507An issue was discovered in GitLab Enterprise Edition 11.2.x …5.3