GitLab has a flaw that allows an authenticated user to modify the CI/CD configuration of a different user by sending specially crafted attributes in pipeline schedule requests, bypassing normal validation checks. The defect can lead to unauthorized changes to build pipelines, exposing the system to accidental or malicious code injection, privileges escalation or denial of service if critical pipeline steps are altered.

GitLab Community Edition and Enterprise Edition are affected. All releases from 18.0 up to just before version 19.0.5, from 19.1 up to just before 19.1.3, and from 19.2 up to just before 19.2.1 are vulnerable. The issue is fixed in GitLab 19.0.5, 19.1.3, 19.2.1 and later.

With a CVSS score of 8.4 the vulnerability is considered high severity. The EPSS score is less than 1%, indicating a low current exploitation probability, and the vulnerability is not listed in CISA KEV. Attacking requires a valid authenticated account, so an attacker must first obtain or use an existing user credential. Once authenticated, the attacker can send crafted pipeline schedule parameters to overwrite or alter another user's CI/CD configuration, potentially impacting confidentiality, integrity and availability of the build system.