EUVD-2026-50477
GHSA-w973-7qcg-m257
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to GitLab EE with low-privilege account
-
DeliveryInitiate token generation under specific undisclosed conditions
-
ExploitAuthorization constraint check improperly enforced during issuance
-
ExecutionToken generated with scope exceeding governance policy
-
ImpactAccess restricted tool or capability in violation of admin policy
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Hardware debugging protection
|
| Exploitation Conditions | Exploitation requires a valid authenticated session with at minimum low-privilege access to a GitLab EE instance (CVSS PR:L confirmed). The bypass is specifically tied to the token generation process and occurs only 'under certain conditions' per the advisory - the exact triggering configuration or API invocation path is not publicly disclosed, and the issue work item at https://gitlab.com/gitlab-org/gitlab/-/work_items/605484 may be restricted. Limiting factors include: authentication is mandatory (unauthenticated exploitation is excluded by PR:L), the vulnerability is scoped to GitLab EE only (not Community Edition), the 'certain conditions' qualifier implies the bypass does not fire universally for all token generation requests, and the impact is restricted to integrity (policy circumvention) with no confidentiality or availability consequence. |
| Impact | The CVSS 4.3 base score reflects a moderate-priority finding: network-accessible (AV:N), low complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), unchanged scope, and low integrity impact (I:L) with no confidentiality or availability impact. The practical risk is bounded by the requirement for a valid authenticated session, the EE-only scope, and the undisclosed 'certain conditions' trigger, which introduces uncertainty about how reliably the bypass can be achieved. No EPSS data was present in the source intelligence, and the vulnerability is not in CISA KEV, with no public POC referenced. Real-world priority is highest for organizations that depend on GitLab EE tool governance to enforce compliance or insider-threat controls - in those environments the integrity impact, though scored low, could represent a meaningful policy failure. For organizations not using EE governance features, exploitability is effectively nil. |
| Exploit ScenarioDerived | An authenticated GitLab EE user with a standard low-privilege account initiates a token generation request under specific conditions that trigger the authorization defect, causing the system to issue a token that is not bound by the administrator's tool governance policy. The user then employs that token to access a tool or capability that policy should have blocked. No public exploit code has been identified at time of analysis, and the 'certain conditions' qualifier suggests the bypass may require non-obvious setup or a specific API flow. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 29, 2026
Improper authorization enforcement during token generation in GitLab Enterprise Edition allows an authenticated low-privilege user to bypass administrator-configured tool governance policies. Affected are all GitLab EE installations running 19.1 before 19.1.3 and 19.2 before 19.2.1. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, the network-accessible, low-privilege attack vector makes this a realistic insider threat in enterprises relying on GitLab EE's governance controls.
RemediationAI
Upgrade GitLab EE to version 19.1.3 (for 19.1.x deployments) or 19.2.1 (for 19.2.x deployments) as the primary fix; both are confirmed by the vendor patch release at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/. If immediate upgrade is not possible, consider restricting token generation to trusted roles via GitLab's role-based access controls, reducing the set of accounts that can initiate token creation. Audit recently issued tokens for scope anomalies against current governance policy as a detection measure. Note that tightening role permissions as a compensating control may affect legitimate workflows - coordinate with development teams before implementing access restrictions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GitLab Enterprise Edition implements tool governance policies that allow administrators to define which development or AI-assisted tools specific user roles may access. CWE-1270 (Generation of Incorrect Security Tokens) identifies the root cause: during the token issuance flow, the authorization logic that should enforce governance policy constraints is not correctly applied, potentially resulting in a token that grants broader access than policy permits. The vulnerability is scoped to the EE product tier - features such as tool governance are EE-only - and affects the token generation subsystem specifically. The CPE cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:* covers the GitLab application; the EE qualifier is established by the advisory text rather than CPE disambiguation.
Know when Gitlab gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Aligns with vendor vector; network-accessible with low privileges, integrity-only impact reflecting policy bypass scope, no confidentiality or availability consequence.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
2DescriptionCVE.org
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to bypass administrator-configured tool governance policies due to improper authorization enforcement during token generation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. Rated critical severity (CVSS 10
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab af
Unauthenticated arbitrary file read in GitLab CE/EE lets remote attackers retrieve files from the GitLab server via the
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows
Remote code execution in GitLab CE/EE (all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2)
Remote code execution in GitLab CE/EE can be triggered by a specially crafted regular expression processed through a vul
Sensitive credential and configuration disclosure in GitLab Enterprise Edition allows an authenticated user with Duo Cha
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Authenticated code execution on the GitLab server is possible in GitLab CE/EE 19.2 through 19.4.0, where an integer over
Exploit-DB