GitLab CVE-2026-82632

Exploitation requires the attacker to already possess a valid GitLab fine-grained Personal Access Token scoped to user-boundary import permissions, and to invoke the project-import function against a group namespace outside that token's intended scope. The flaw is specifically in authorization of the import target namespace during project import, so only environments where such user-boundary-scoped import tokens are issued are exposed. Exploitation is LIMITED by the need for an authenticated token (PR:L), the high attack complexity (AC:H, reflecting the 'under certain conditions' qualifier), and affected-version constraints - fixed in 19.2.8, 19.3.5, and 19.4.2. No user interaction by a victim is required (UI:N).

This is a low-severity issue that does not warrant emergency prioritization. The vendor CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N = 3.1) describes a network-reachable but high-complexity, authenticated flaw with only limited integrity impact and no confidentiality or availability loss - consistent with a scope/authorization check failure (CWE-863) rather than code execution or data theft. Signals are not conflicting but they are modest: a public proof-of-concept exists (HackerOne #3843143), yet there is no EPSS score provided, no CISA KEV listing, and no SSVC decision data in the input, so there is no evidence of active exploitation or automatability. The practical risk is that a user who already holds a valid fine-grained Personal Access Token can import projects into group namespaces outside the token's intended user-boundary scope - an insider/token-scope escalation, not a pre-auth breach. Note the tag 'Authentication Bypass' is a mischaracterization: PR:L confirms authentication is required, so this is an authorization/scope-boundary bypass. Net: real but low priority - patch in normal maintenance cycles; the AC:H and PR:L requirements plus absence of KEV/EPSS argue against widespread opportunistic exploitation.

An authenticated GitLab user who has been issued a fine-grained Personal Access Token scoped only to user-boundary import permissions crafts an import request targeting a group namespace outside that intended scope. Because the import target namespace is not correctly authorized, the project is imported into the broader group, exceeding the token's granted boundary. A public proof-of-concept exists (HackerOne report), but the high attack complexity means specific conditions must be met for the import to succeed.