The vulnerability is a time‑of‑check, time‑of‑use (TOCTOU) race condition that surfaced during GitLab pipeline creation. It enabled a user with developer access to trigger actions that were executed in the context of another user’s merge request commit. The flaw could therefore allow a developer to perform operations normally restricted to the author of the merge request, effectively elevating privileges within the project. This weakness is classified as CWE‑367.

It affects GitLab Community Edition and Enterprise Edition in all releases from 13.0 through 19.1.7, 19.2.0‑19.2.5, and 19.3.0‑19.3.1. The official mitigation is upgrading to version 19.1.8, 19.2.6, 19.3.2 or any later release that includes the patch.

The CVSS score of 6.4 indicates a moderate severity, and the EPSS score of less than 1% shows a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, and the most likely attack vector is an internal developers triggering simultaneous pipeline creations to exploit the race condition. Given the moderate score, systems should treat it as a low‑to‑moderate risk and address it promptly.