Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without the required push permissions due to improper authorization in pipeline reference validation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-08-12T18:17:23.820Z",
  "pubdate": "2026-08-12T18:17:23.820Z",
  "executiveSummary": "An improper authorization vulnerability exists in GitLab CE/EE pipeline reference validation, allowing authenticated users with developer-role permissions to bypass security controls. Specifically, under certain conditions, a developer-level user can execute CI/CD pipelines on protected branches without possessing the required push permissions.\nThe vulnerability affects GitLab CE/EE versions 19.0 prior to 19.0.6, 19.1 prior to 19.1.4, and 19.2 prior to 19.2.2. The risk implications include the potential unauthorized execution of deployment jobs, unauthorized script execution within sensitive environments, and potential compromise of protected code branches via automated workflows.\nExploitation requires authenticated access with a minimum privilege level of the developer role. The attacker leverages flaws in the pipeline reference validation logic to bypass authorization checks that normally restrict execution on protected branches to users with explicit push access.\nRemediation requires upgrading the affected GitLab installations to the patched versions provided by GitLab (19.0.6, 19.1.4, 19.2.2 or later).",
  "technicalDetails": "The root cause of the vulnerability stems from improper authorization logic during pipeline reference validation within the CI/CD pipeline execution subsystem of GitLab CE/EE. The system fails to correctly verify whether an authenticated user attempting to trigger a pipeline holds the necessary push permissions for designated protected branches.\nThe vulnerable component resides in the GitLab authorization and pipeline validation codebase responsible for enforcing branch protection rules. Affected versions include all instances of GitLab CE/EE spanning versions 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2.\nThe attack flow proceeds as follows: 1) An authenticated user provisioned with a developer-role attempts to trigger a CI/CD pipeline targeting a protected branch where they lack direct push permissions. 2) Due to flawed reference validation logic, the authorization check improperly evaluates the user's permissions or fails to validate the context against protected branch constraints. 3) The validation routine incorrectly permits the pipeline creation request. 4) The CI/CD subsystem executes the pipeline against the protected branch, potentially granting the attacker the ability to run arbitrary job scripts, access deployment secrets tied to the protected environment, or alter the state of the protected reference.\nAuthentication is required, specifically leveraging an active session or API token belonging to an authenticated user. The privilege requirement is constrained to the developer role, which is typically considered a trusted internal permission level, thereby increasing the risk of lateral movement or unauthorized deployments by malicious or compromised internal actors. Network exposure is aligned with the standard accessibility of the GitLab instance HTTP/HTTPS interface."
}