Executive brief
GitLab Enterprise Edition contains an authorization bypass vulnerability in its protected environments feature that allows authenticated maintainers to access environment terminals they should not have permission to use. An attacker with project maintainer privileges could exploit this to gain unauthorized access to production or other restricted environments, potentially leading to unauthorized code execution or sensitive data exposure.
Technical details
This is an improper access control vulnerability (CWE-284) in GitLab EE's protected environments terminal access mechanism. The vulnerability stems from insufficient authorization checks that fail to properly validate whether an authenticated user with project Maintainer permissions should have access to a specific protected environment's terminal. The attack requires network access and prior authentication, with the attacker already holding Maintainer role in the project. An authenticated Maintainer can bypass environment-level access controls to access terminals in protected environments they are not explicitly authorized to use, potentially executing arbitrary commands. Patches were released in versions 19.1.7, 19.2.5, and 19.3.1.
Affected products
- GitLab GitLab Enterprise Edition 11.3 before 19.1.7, 19.2 before 19.2.5, 19.3 before 19.3.1
Timeline
- 2026-08-26: disclosed
- 2026-08-26: patched: Fixed in versions 19.1.7, 19.2.5, and 19.3.1