GitLab CE/EE versions starting from 17.2 up to but excluding 17.3.7, from 17.4 up to but excluding 17.4.4, and from 17.5 up to but excluding 17.5.2 contain a vulnerability that could allow an attacker with full API access via the Device OAuth flow to exploit improper restriction of rendered UI layers or frames. This vulnerability has a medium severity rating and a patch is available.