CVE-2026-103515: Incorrect Authorization in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when an instance administrator locked a group's Duo availability, an authenticated user with group Owner permissions could have re-enabled AI-backed data egress to a third-party service for that group and its descendant projects, due to insufficient granularity of the admin-lock enforcement controls.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.3.6 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.4.3 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.5.1
Event History
Frequently Asked Questions
Which deployments are affected?
GitLab EE instances are affected if they run a version from 19.2 before 19.3.6, 19.4 before 19.4.3, or 19.5 before 19.5.1. The issue applies where an instance administrator has locked a group's Duo availability.
What access does an attacker need?
An attacker must be authenticated and have Owner permissions for the affected group. They can then re-enable AI-backed data egress to a third-party service for that group and its descendant projects despite the administrator's lock.
What is the security impact?
The issue can undermine an instance administrator's intended restriction on Duo availability by allowing group Owners to re-enable AI-backed data egress. The stated impact is integrity-only, with no confidentiality or availability impact listed.