:warning: **Please read [the process](https://gitlab.com/gitlab-org/release/docs/-/blob/master/general/security/engineer.md) on how to fix security issues before starting to work on the issue. Vulnerabilities must be fixed in a security mirror.** **[HackerOne report #3356284](https://hackerone.com/reports/3356284)** by `iamgk808` on 2025-09-24, assigned to `GitLab Team`: [Report](#report) | [Attachments](#attachments) | [How To Reproduce](#how-to-reproduce) ## Report ##### Summary Hackerone team note: PR:L - because the custom role is only used in the attacker group, not in the victim group I found a weird bug where a custom role can add any project runner to an attacker project and control, like edit, pause, etc...  ==The main issue is that the custom role `guest+Manage runners` can add any project runner in the instance & control it== simple POC: victim : 1. `victim` creates a private project & adds a runner to it attacker: 1. `attacker` creates an `attacker-group-1` & adds ultimate trial to it 2. `attacker` creates a custom role `guest+Manage runners` & adds the `attacker-2` with the custom role 3. `attacker` creates a `attacker-project-1` in the `attacker-group-1` & notes the project ID 4. Log in as `attacker-2` & use the below API & where the runner ID is the victim runner ID (it's an incremental value, so it's too guessable & also in the local instance it starts with 1, 2, 3, 4, etc...) ``` curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/projects/9/runners" \ --form "runner_id=9" ``` 5. Go to the `attacker-project-1` > ci/cd settings> runners, where you can manage the victim runner like edit, pause, etc... ##### Steps to reproduce two users - victim, attacker-1, attacker-2 #### Victim steps: 1. Create a new group called `group-1` & apply GitLab Ultimate trial to it 2. In the group, create a private project called `project-1` 3. go to `project-1` > `ci/cd settings`> `runners` & create a project runner   4. Then follow the register runner setup & add the runner  5. Note the runner ID in the URL  #### attacker steps: 1. Create a new group called `attacker-group-1` & apply GitLab Ultimate trial to it 2. `attacker-1` creates a custom role `guest+Manage runners` & adds the `attacker-2` with the custom role 3. `attacker-1` creates a `attacker-project-1` in the `attacker-group-1` & notes the project ID 4. Log in as `attacker-2` & use the below API & where the runner ID is the victim runner ID (it's an incremental value, so it's too guessable & also in the local instance it starts with 1, 2, 3, 4, etc...) Replace the value below, `project-id` with the attacker `attacker-project-1` `runner_id` with the victim runner ID `your_access_token` - create an `api` scope token with the `attacker-2` account ``` curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/projects/project-id/runners" \ --form "runner_id=9" ``` 5. Go to the `attacker-project-1` > ci/cd settings> runners, where you can manage the victim runner like edit, pause, etc...    ##### Impact IDOR able to add any project runner to the attacker project and manage the runner ##### Examples ##### What is the current *bug* behavior? IDOR able to add any project runner to the attacker project and manage the runner ##### What is the expected *correct* behavior? Only the authorized user can edit ##### Relevant logs and/or screenshots ##### Output of checks This bug happens on GitLab.com ###### Results of GitLab environment info #### Impact IDOR able to add any project runner to the attacker project and manage the runner ## Attachments **Warning:** Attachments received through HackerOne, please exercise caution! * [image.png](https://h1.sec.gitlab.net/a/780eb686-7030-4bac-abb6-ac85c4357d93/image.png) * [image.png](https://h1.sec.gitlab.net/a/669f454c-e1e3-4774-b83c-604e36d70513/image.png) * [image.png](https://h1.sec.gitlab.net/a/9e38c7aa-d660-49f7-bb39-4aad5c5c4a9a/image.png) * [image.png](https://h1.sec.gitlab.net/a/02f00a2e-7ce5-4337-959a-714ee05c4782/image.png) * [image.png](https://h1.sec.gitlab.net/a/9afa144f-2aca-4765-98e0-bc918963412f/image.png) * [image.png](https://h1.sec.gitlab.net/a/c3744d46-13bb-4fde-9987-121771157cc7/image.png) * [image.png](https://h1.sec.gitlab.net/a/5c189961-d5a9-483c-b95c-4a59cbb16afd/image.png) * [image.png](https://h1.sec.gitlab.net/a/e6913bad-2efe-43e1-bf5a-024d305983ca/image.png) ## How To Reproduce Please add [reproducibility information] to this section: 1. 1. 1. [reproducibility information]: https://about.gitlab.com/handbook/engineering/security/#reproducibility-on-security-issues