When an instance-wide SAML or LDAP membership lock is enabled, an authenticated user can grant or accept project and group memberships that bypass the identity provider’s control because the lock is not enforced on pre‑existing requests. This flaw allows the creation of unauthorized memberships, potentially giving attackers access to sensitive resources within the GitLab environment.

GitLab Enterprise Edition versions from 12.0 through but excluding 19.3.6, 19.4 through but excluding 19.4.3, and 19.5 through but excluding 19.5.1 are affected when the instance‑wide SAML or LDAP membership lock is enabled. The vulnerability is specific to GitLab EE instances that have an SAML or LDAP configuration with the membership lock feature activated.

The CVSS score of 5.9 indicates moderate severity, and the EPSS score is not available, suggesting no measurable current exploitation trend. The flaw is not listed in the CISA KEV catalog. An attacker must be an authenticated user on the affected instance; with the lock turned on, they can add themselves or others to projects and groups, thus escalating privileges within the GitLab ecosystem. The impact is confined to the scope of the attacker’s authenticated session, but unauthorized group membership can expose sensitive code and configuration data to malicious actors.