GitLab contains an improper authorization flaw that can allow an authenticated user with maintainer‑level permissions to delete package registry metadata that should be protected for higher roles. The vulnerability is rooted in CWE‑863 and could undermine the integrity of package metadata without granting code execution or privilege escalation, resulting in data loss and disruption of package protection policies.

GitLab Community Edition and Enterprise Edition versions from 17.6 up to, but not including, 19.2.8, from 19.3 up to, but not including, 19.3.5, and from 19.4 up to, but not including, 19.4.2 are affected.

The CVSS score of 2.7 classifies the issue as low severity, EPSS data is not available, and it is not listed in the CISA KEV catalog. Exploitation requires authentication and a maintainer role; an attacker would need access to a repository where the maintainer can target package metadata. The likelihood of exploitation is considered low due to the modest CVSS and the need for relative privilege, but it remains a data‑integrity concern for organizations relying on strict package protection rules.