GitLab’s access control logic for labels contains a granularity error that can let a user who holds a project-scoped, fine‑grained Personal Access Token delete or modify group-level labels. This flaw permits an authenticated attacker to affect organizational metadata that is scoped above the project level, potentially disrupting CI/CD workflows and compromising configuration integrity.

GitLab Community Edition and Enterprise Edition are vulnerable in all releases from 18.11 up to 19.2.7, from 19.3.0 up to 19.3.4, and from 19.4.0 up to 19.4.1. Upgrading to 19.2.8, 19.3.5, or 19.4.2 or any newer release removes the issue.

The CVSS score of 4.3 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of widespread exploitation. The likely attack vector is an authenticated user who has obtained a back‑door fine‑grained PAT; such a user can exercise the privilege over group labels regardless of intended scope. No additional prerequisites are required beyond possession of the token, making the vulnerability challenging but not trivial to exploit.