GitLab's downstream pipeline creation service contains an incorrect authorization check that can allow a developer‑level user to trigger CI/CD pipelines on protected branches, giving the user execution privileges beyond those normally permitted. The flaw could let the attacker run arbitrary jobs, potentially retrieve sensitive data or alter repository contents. The weakness corresponds to CWE‑863, incomplete access control.

All GitLab Community and Enterprise Edition installations are affected. Specifically, versions from 18.7 up to (but not including) 19.2.8, from 19.3 up to (but not including) 19.3.5, and from 19.4 up to (but not including) 19.4.2 can be exploited. Versions 19.2.8, 19.3.5, 19.4.2 and later contain the fix.

The vulnerability scores an 8.5 on the CVSS scale, indicating high severity. Although an EPSS score is not available, the lack of removal from the KEV catalog suggests it has not yet been widely abused, yet the condition requires an authenticated developer user, which is common in many GitLab deployments. An attacker with such credentials could directly trigger pipelines on protected branches, making exploitation realistic in environments where developers have access to the repository and its protected branches.