Description

GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed a user with a pending membership to receive permissions granted by a custom role, due to incorrect privilege assignment that did not account for membership state.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-08-12T20:17:33.120Z",
  "pubdate": "2026-08-12T20:17:33.120Z",
  "executiveSummary": "An incorrect privilege assignment vulnerability has been identified in GitLab EE that impacts all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2.\nThe security flaw arises due to incorrect privilege assignment logic that fails to account for the membership state of a user.\nUnder specific conditions, this allows a user holding a pending membership state to improperly receive and exercise permissions granted via a custom role within the affected system.\nThe risk implications include unauthorized access to project resources and elevated functional capabilities by actors whose membership has not yet been fully approved or activated.\nAttack capabilities require authenticated access where a user with a pending membership state can leverage the logic flaw to inherit unauthorized privileges.\nRemediation requires upgrading the GitLab EE installation to the patched version releases provided by the vendor.",
  "technicalDetails": "The vulnerability resides within the access control and role-based access control (RBAC) subsystem of GitLab EE, specifically in the privilege assignment logic governing custom roles.\nThe root cause of the issue is a failure in state validation where the authorization mechanism improperly verifies whether a user membership is fully active versus remaining in a pending state.\nThe affected components are the privilege assignment modules responsible for evaluating user roles and permissions against group or project memberships.\nImpacted product versions encompass all iterations of GitLab EE from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2.\nExploitation requires an authenticated user who possesses a pending membership status within a target group or project.\nDuring the step-by-step attack flow, the user requests or attempts actions associated with an assigned custom role while their membership remains pending.\nBecause the authorization checks fail to evaluate the membership state correctly, the system evaluates the custom role assignments independently of the pending status.\nAs a result, the permissions tied to the custom role are erroneously granted to the user.\nPost-exploitation impact includes unauthorized data access, execution of privileged functions, or modification of repository assets depending on the scope of the custom role assigned to the pending membership.\nNo remote unauthenticated exposure is present, as the attack requires valid system authentication and an existing pending membership context."
}