An improper authorization check within GitLab EE’s API allows a user with a developer role to modify protected environment settings that should be restricted to higher-privilege accounts. This flaw can lead to deployment pipeline alterations or the introduction of malicious configuration changes, potentially impacting the confidentiality, integrity, and availability of applications deployed through GitLab’s CI/CD. The weakness is cataloged as CWE‑863, indicating a failure to enforce least privilege.

GitLab Enterprise Edition versions from 11.3 up to, but not including, 18.8.9, from 18.9 up to, but not including, 18.9.5, and from 18.10 up to, but not including, 18.10.3 are affected. Users of these releases must verify their version and whether it falls into the vulnerable range.

The vulnerability has a CVSS score of 4.3, reflecting moderate impact when an authenticated developer can influence protected environments. The EPSS score is below 1 %, indicating a low probability of exploitation. The flaw is not listed in CISA’s KEV catalog. Attackers must be authenticated and possess developer-level permissions; thus the path is limited to legitimate users who may have more access than intended.