CVE-2022-1148

CVE-2022-1148 is an improper authorization vulnerability in GitLab Pages, affecting GitLab CE/EE versions prior to 14.7.7, 14.8.5, and 14.9.2. This flaw allows an attacker to steal a user's access token from an attacker-controlled private GitLab Pages website and subsequently reuse it on the victim's other private websites. With a CVSS score of 6.5 (Medium), this vulnerability has a network attack vector and low attack complexity, requiring user interaction to exploit. The primary impact is high confidentiality, as an attacker can gain unauthorized access to private resources. There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit or Nuclei. While there is limited community discussion and media coverage, organizations are advised to apply the relevant patches to mitigate this risk.