An improper privilege assignment flaw allows an authenticated user with a custom role that includes compliance framework administration permissions to configure and run a specially crafted compliance pipeline across group projects. This weakness enables unauthorized execution of potentially sensitive automation, exposing the organization to data manipulation or service disruption. The flaw is classified as CWE-266: Permissions, Access Control Issues.

GitLab, all versions from 17.0 up to but not including 19.2.8, 19.3.5, and 19.4.2. Versions 19.2.8, 19.3.5, and 19.4.2 and newer contain the fix.

The CVSS base score of 4.3 indicates moderate severity. EPSS is not available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. An attacker must be authenticated and already possess a custom role with compliance framework administration rights to exploit this issue, which limits the threat surface but still poses a risk if such roles are granted too broadly. The exploitation path requires launching a compliance pipeline that runs across group projects, potentially affecting multiple repositories and users.