GitLab EE EUVD-2026-50478

The target GitLab EE instance must have the AI-assisted code review feature enabled - this is an EE-tier feature and is not present in Community Edition. The attacker must hold at least a low-privilege authenticated account on the instance (PR:L per CVSS), sufficient to open or contribute to a merge request that triggers AI code review. GitLab's disclosure notes 'under certain conditions' without specifying whether a particular project configuration, AI model backend, or feature flag state is required - this ambiguity is a confirmed gap in the public advisory. Exploitation is limited to confidentiality impact only; no write or destructive capability is implied. The cross-project data access boundary is the key limiting factor: only information accessible to the AI backend's inference context is at risk, not arbitrary data outside that scope.

The official CVSS 3.1 score of 4.3 (Medium) accurately reflects a constrained impact: network-accessible, low-complexity exploitation requiring only low-level authentication, but producing only limited confidentiality impact with no integrity or availability consequences and no scope change. EPSS data was not supplied, and the vulnerability is absent from the CISA KEV catalog, indicating no confirmed mass exploitation. The 'Authentication Bypass' tag in the source data is potentially misleading - this is more precisely an authorization bypass (cross-project data access by an already-authenticated user) rather than a bypass of authentication itself. Real-world risk is elevated by the fact that AI code review is an EE feature often used broadly by development teams, and that any authenticated GitLab user meeting the unspecified 'certain conditions' could be an insider threat. The vague disclosure of exploitation conditions ('under certain conditions') is a gap: defenders cannot fully model exposure without knowing which specific AI feature states or project configurations are required. Overall, this is a genuine but moderate priority: patch on the normal maintenance cycle unless insider threat is a high concern for the environment.

An authenticated GitLab EE developer with access to one project crafts a merge request containing code comments or content designed to inject instructions into the AI code review prompt - for example, directives instructing the model to include context or summaries from other projects it has internal access to. When the AI review feature processes the merge request, the injected content causes the model to surface file contents, comments, or metadata from a separate, restricted project that the attacker does not have explicit authorization to view. No public proof-of-concept has been identified, but the attack is consistent with well-documented prompt injection techniques requiring no special tooling beyond knowledge of the target AI system's behavior.