GitLab EUVD-2026-98207

Exploitation requires an authenticated GitLab EE user who already holds a specific granular permission (PR:L), and the environment must use the GitLab Duo Agent Platform with governance controls configured - the flaw lets such a user obtain a Duo token that bypasses those controls under unspecified 'certain conditions.' Exploitation is limited to GitLab Enterprise Edition (not Community Edition), to deployments that have adopted Duo Agent Platform, and only to users granted the relevant permission; it does not work for unauthenticated or arbitrary low-privilege accounts, which substantially constrains real-world risk beyond the raw network attack vector.

This is a medium-severity, lower-priority issue rather than an urgent threat. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) describes a network-reachable but authenticated (PR:L) flaw with only limited integrity impact and no confidentiality or availability impact, consistent with CWE-807 (reliance on untrusted input in a security decision). No EPSS score, CISA KEV listing, or POC was provided in the intelligence set, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the signals are internally consistent (modest CVSS, no exploitation indicators) rather than conflicting. The key limiting factor is that an attacker must already be an authenticated GitLab user holding a specific granular permission, and the environment must meet unspecified 'certain conditions' involving the GitLab Duo Agent Platform, which narrows the realistic attacker population to insiders or those with a foothold in an organization already using Duo. Net: a legitimate issue worth patching on a normal cycle, but not a drop-everything emergency absent exploitation evidence.

An authenticated GitLab EE user who holds a particular granular permission manipulates untrusted input that GitLab trusts when issuing a GitLab Duo Agent Platform token, obtaining a token that bypasses the organization's governance controls. The attacker then uses that token to invoke Duo Agent capabilities beyond their intended policy limits. No public proof-of-concept exploit was provided, and exploitation requires valid credentials plus the specific permission.