An authorization flaw in GitLab allows a user with developer role to delete protected container registry tags. The vulnerability stems from missing authorization checks during the delete operation. If exploited the attacker can modify or remove important images, potentially leading to loss of application integrity, supply‑chain contamination, or denial of service to teams relying on those images.

GitLab Community and Enterprise editions are affected. Versions are all releases from 17.10 up to, but not including, 18.9.7, from 18.10 up to 18.10.6, and from 18.11 up to 18.11.3. The vendor responsible is GitLab Inc.

The CVSS score is 4.3, indicating a low to moderate severity. EPSS information is missing, so exploitation probability is unclear. The vulnerability is not listed in the CISA KEV catalog. Attack requires an authenticated session with developer‑level permissions, so the attack surface is limited to committed users of the impacted GitLab instance.