Executive brief
GitLab Enterprise Edition contains a security flaw in its AI Duo Workflows component. An authenticated user could manipulate API requests to access and use AI model settings belonging to other organizations or departments. This could lead to unauthorized use of premium AI resources or the bypass of organizational AI restrictions.
Technical details
A missing authorization vulnerability exists in the Duo Workflows API within GitLab EE. The 'find_root_namespace' helper method in 'ee/lib/api/ai/duo_workflows/workflows.rb' uses 'find_namespace' instead of 'find_namespace!', which fails to verify user permissions for the requested namespace. An authenticated attacker can manipulate the 'root_namespace_id' query parameter or the 'X-Gitlab-Namespace-Id' header to access and utilize AI model configurations from namespaces they do not own. This allows for the unauthorized use of AI models and potential bypass of administrative restrictions. The issue is fixed in versions 18.5.5, 18.6.3, and 18.7.1.
Affected products
- GitLab GitLab Enterprise Edition (EE) 18.4 to 18.5.4, 18.6 to 18.6.2, 18.7 to 18.7.0
Timeline
- 2026-01-07: patched: GitLab released versions 18.7.1, 18.6.3, and 18.5.5.
- 2026-01-09: disclosed: Initial NVD publication.
References
- https://about.gitlab.com/releases/2026/01/07/patch-release-gitlab-18-7-1-released/
- https://gitlab.com/gitlab-org/gitlab/-/issues/581268
- https://access.redhat.com/security/cve/CVE-2025-13772
- https://bugzilla.redhat.com/show_bug.cgi?id=2428224
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-13772.json