The vulnerability is a flaw in GitLab’s pipeline reference validation that allows an authenticated user with developer‑level permissions to execute CI/CD pipelines on a protected branch, even though the user does not have the required push rights. This improper authorization means an attacker can run arbitrary code on a protected code base, potentially leading to code injection, data exfiltration, or further lateral movement in the system. The weakness is identified as CWE‑863, which relates to missing or incorrect authorization checks.

GitLab CE/EE, all releases from 19.0 up to but not including 19.0.6, from 19.1 up to but not including 19.1.4, and from 19.2 up to but not including 19.2.2. The affected product is the standard GitLab repository and CI/CD platform.

The CVSS score of 8.5 indicates high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploits to date. Because the attack requires an authenticated user with at least developer role, the likely vector is an insider or compromised account. The privilege escalation could be achieved by simply forming a pipeline trigger URL or API call that targets a protected branch without including push permissions. Given the absence of a public exploit, the probability of immediate exploitation remains uncertain, but the impact remains potentially catastrophic if an attacker gains sufficient access.