Vulnerability · Published Oct 21, 2026 · Assigned by GitLab

CVE-2026-103515Incorrect Authorization in GitLab

Low 2.7

In plain English

A low-severity incorrect authorization in GitLab from GitLab. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)2.7Low

Exploit odds (30 days)0.2%top 85.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

GitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when an instance administrator locked a group's Duo availability, an authenticated user with group Owner permissions could have re-enabled AI-backed data egress to a third-party service for that group and its descendant projects, due to insufficient granularity of the admin-lock enforcement controls.

Affected products (as reported)

Vendor	Product	Versions
GitLab	GitLab	19.2 – before 19.3.619.4 – before 19.4.319.5 – before 19.5.1

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/631564
HackerOne Bug Bounty Report #3871692 technical-description, exploit, permissions-required
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/