Executive brief
GitLab has fixed a security flaw in its Community and Enterprise editions that could allow a former project member to continue making changes to a project. Specifically, a user who previously held a 'Developer' role could still commit code to a project even after their access was revoked, provided certain merge request settings were enabled. This could lead to unauthorized code changes by individuals who should no longer have write access to the repository.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in GitLab CE/EE versions 10.6 through 19.2.1. The flaw resides in the authorization checks for merge request collaboration settings. Under specific conditions, an authenticated user who previously held a Developer role but was subsequently removed from the project could still commit changes to that project. This occurs because the system fails to properly re-validate the user's current membership status when they attempt to interact with merge requests where collaboration was previously enabled. The vulnerability is patched in versions 19.0.5, 19.1.3, and 19.2.1.
Affected products
- GitLab GitLab Community Edition 10.6 to <19.0.5, 19.1 to <19.1.3, 19.2 to <19.2.1
- GitLab GitLab Enterprise Edition 10.6 to <19.0.5, 19.1 to <19.1.3, 19.2 to <19.2.1
Timeline
- 2026-07-29: patched: GitLab released versions 19.2.1, 19.1.3, and 19.0.5 to address the issue.
- 2026-07-29: advisory: NVD published the CVE record.