EUVD-2026-42403
GHSA-qfqq-fmmm-p2r3
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
GitLab is network-accessible (AV:N), but PR:H is correct as exploitation requires an existing high-privilege group account; only group settings integrity is affected (I:L), with no confidentiality or availability impact.
Primary rating from Vendor (gitlab).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
GitLab has remediated an issue in GitLab EE affecting all versions from 16.10 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user to modify group-level settings beyond their intended permissions due to improper authorization controls.
AnalysisAI
Improper authorization in GitLab Enterprise Edition allows an already-authenticated high-privilege user to modify group-level settings beyond the scope their role should permit. Affecting all EE versions from 16.10 through the patched releases of 18.11.7, 19.0.4, and 19.1.2, the flaw enables unauthorized integrity changes to group-wide policies without any user interaction. No public exploit or active exploitation has been identified at time of analysis, and the PR:H CVSS requirement substantially constrains real-world risk to a narrow set of already-privileged insiders.
Technical ContextAI
The root cause is CWE-863 (Incorrect Authorization), a class of flaw in which access control checks are performed but enforce boundaries incorrectly - the system validates that the user is authenticated and holds a high-privilege role, but fails to verify that the specific action requested is within that role's permitted scope. GitLab EE group-level settings govern team-wide policies including membership visibility, project creation restrictions, and integration configurations. Because these checks are bypassed only under unspecified conditions, the authorization logic likely contains a conditional path or permission-aggregation edge case rather than a wholesale absence of checks. Affected products are confined to the Enterprise Edition (EE) commercial offering; Community Edition is not listed in the vendor advisory or EUVD affected version data.
RemediationAI
Upgrade GitLab EE to a patched release: 18.11.7 (for installations on the 16.10-18.x line), 19.0.4 (for the 19.0.x line), or 19.1.2 (for the 19.1.x line), as detailed in the vendor advisory at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-2-released/. If immediate patching is not operationally feasible, apply the principle of least privilege to group owner assignments - audit all accounts holding group owner or equivalent high-privilege roles and revoke any that are not strictly necessary, since exploitation requires this privilege level. Review current group-level settings across all EE groups for unauthorized changes made prior to remediation. The trade-off of restricting group owner assignments is reduced delegation flexibility, but it directly eliminates the attacker prerequisite until the patch can be applied.
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. Rated critical severity (CVSS 10
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. Rated critical severity (CVSS 9.8)
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions star
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab af
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions sta
An issue was discovered in GitLab Omnibus 7.4 through 12.2.1. Rated critical severity (CVSS 9.8), this vulnerability is
An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today