GitLab EE CVE-2026-81839

Exploitation requires an authenticated GitLab EE user (PR:L) with the ability to transfer a project that has a configured scheduled pipeline execution policy into a new group; the flaw is the improper cleanup of those scheduled pipeline execution policy records during the transfer, leaving stale schedules that execute with the destination group's privileges. Limiting factors: only GitLab EE (not CE) editions in the specified version ranges are affected, the project must have had a scheduled pipeline execution policy, the transfer/scheduling 'certain conditions' must align (reflected as AC:H), and user interaction is required (UI:R). These prerequisites mean an attacker cannot trigger it remotely without a valid account and the specific project-transfer workflow, so it is not exploitable against a default, untouched configuration.

Signals point to a moderate, conditional privilege-escalation risk rather than a mass-exploitation emergency. The CVSS 7.7 (High) vector CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N shows network reach but three meaningful brakes: high attack complexity (AC:H, the 'under certain conditions' language), required privileges (PR:L, an authenticated user), and required user interaction (UI:R). The scope change (S:C) and C:H/I:H are what push the score up, reflecting that pipelines run with the new group's elevated privileges. A HackerOne report (#3925062) is cited as an exploit reference, so publicly available exploit code exists; however, there is no CISA KEV listing and no EPSS value was supplied in the input, so there is no evidence of active or widespread exploitation. NOTE: EPSS score is MISSING from the input and cannot be weighed. The practical priority is driven by the combination of a public PoC and the sensitive CI/CD impact in enterprise GitLab, tempered by the authentication, interaction, and specific-condition requirements that make opportunistic mass exploitation unlikely. The 'Authentication Bypass' tag conflicts with CWE-863 (Incorrect Authorization) and the description, which describe an authorization/privilege flaw in authenticated users, not an authentication bypass - treat the tag with caution.

An authenticated GitLab user who can transfer a project that has a scheduled pipeline execution policy moves it into a different group; due to improper cleanup of the scheduled policy records, the stale schedule continues to fire and runs CI/CD pipelines with the new group's elevated privileges, giving the attacker code execution in that group's context. Public exploit material is referenced via a HackerOne report, and the high attack complexity (AC:H) plus required user interaction (UI:R) mean the specific transfer/scheduling conditions must line up for success.