An authenticated user with Maintainer permissions can alter protected branch settings through a project API endpoint that lacks proper authorization checks. This flaw allows the maintainer to bypass branch protection controls, which could enable unauthorized commit merges, introduction of malicious code, or disruption of repository integrity. The weakness is identified as an improper authorization flaw (CWE‑862).

GitLab Community Edition and Enterprise Edition users with versions starting from 12.8 up through 19.0.4, 19.1.2, and 19.2.0 are vulnerable. The issue is resolved in GitLab releases 19.0.5, 19.1.3, 19.2.1, and any later versions.

The CVSS score of 4.9 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability requires an authenticated user with Maintainer role, so it is internal to the organization. The condition “under certain conditions” in the description is not elaborated, but the attack path likely involves authorized API calls that modify branch protection settings. The flaw is not listed in CISA’s KEV catalog, further reflecting a lower exploitation probability.