Executive brief
GitLab Enterprise Edition contains a flaw that allows authenticated users with Owner or Maintainer permissions to silently disable deployment approval requirements for protected environments. An attacker exploiting this vulnerability could bypass security controls and deploy unapproved code directly to production environments, potentially exposing the organization to unauthorized changes and operational risk.
Technical details
The vulnerability is an access control implementation issue in GitLab EE's protected environment approval rules functionality. The flaw exists because authorization checks are performed after the protected resource has been modified, allowing an authenticated user with Owner or Maintainer permissions to silently disable deployment approval requirements. The attack requires valid high-privilege credentials on the GitLab instance, and the attacker can directly modify deployment safeguards without triggering expected audit or approval workflows. Patches are available in GitLab 19.1.8, 19.2.6, and 19.3.2.
Affected products
- GitLab GitLab EE 17.1 before 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2
Timeline
- 2026-09-16: disclosed
- 2026-09-10: patched: Patched in versions 19.1.8, 19.2.6, and 19.3.2