Description

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to modify project settings restricted to higher-privileged roles, due to missing authorization checks on a project update endpoint.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-12T20:17:37.640Z",
  "pubdate": "2026-08-12T20:17:37.640Z",
  "executiveSummary": "A missing authorization vulnerability has been identified in GitLab EE affecting all versions from 19.1 prior to 19.1.4 and 19.2 prior to 19.2.2. The security flaw stems from absent authorization checks on a project update endpoint, which under certain conditions permits an authenticated user to modify project settings that are strictly restricted to higher-privileged roles. The primary impact of this vulnerability is unauthorized privilege escalation within the scope of project settings management, potentially allowing lower-privileged actors to alter critical configuration boundaries established by administrators or maintainers. The risk implication centers on the compromise of project integrity and confidentiality controls, as malicious or unauthorized configuration modifications could disrupt workflows or expose sensitive assets. To exploit this vulnerability, an attacker must possess authenticated access to the target environment and interact with the vulnerable project update endpoint under the specific conditions where authorization enforcement fails. Remediation requires updating the affected GitLab EE instances to the patched versions provided by the vendor.",
  "technicalDetails": "The vulnerability resides within the project management and configuration subsystem of GitLab EE, specifically in a project update endpoint responsible for processing state and configuration modifications. The root cause of the security defect is an implementation flaw characterized by missing authorization checks prior to executing the state change request. Specifically, the affected endpoint fails to validate whether the calling user context possesses the requisite administrative or maintainer privileges mandated for modifying restricted project settings. Consequently, the application processes incoming update requests without adequately enforcing role-based access control (RBAC) boundaries. The affected software versions comprise all instances of GitLab EE from 19.1 before 19.1.4 and 19.2 before 19.2.2. Exploitation of this vulnerability requires the attacker to be authenticated within the application and to target the vulnerable project update endpoint. Although authentication is required, the privilege requirement is effectively bypassed due to the missing access control checks, enabling a standard or lower-privileged authenticated user to perform actions reserved for higher-privileged roles. The attack flow begins when an authenticated user crafts an HTTP request directed at the vulnerable project update endpoint, containing parameters intended to modify restricted project settings. Because the backend code omits the necessary role verification logic, the application processes the payload and updates the project configuration accordingly. Post-exploitation impact includes unauthorized modification of critical project properties, deviation from security baselines, and potential circumvention of organizational governance policies governing project management."
}