GitLab Enterprise Edition contains a flaw that allows an authenticated user with developer‑level permissions to change the settings of a protected deployment environment via the API. The improper authorization check permits the user to bypass the intended restriction, potentially enabling the deployment of code to environments that should only be accessed by higher‑privileged roles. The weakness is a classic checks‑before‑use error (CWE‑863). While it does not directly execute arbitrary code, the ability to reconfigure protect‑ed pipelines can lead to privilege escalation and unauthorized application deployments, harming confidentiality, integrity, and availability of the affected services.

All GitLab Enterprise Edition installations from version 11.3 up through 18.8.8, 18.9.4, and 18.10.2 are impacted. The issue has been fixed starting with GitLab 18.8.9, 18.9.5, and 18.10.3 and newer releases. Any instance running an affected version should be upgraded to a patched release to eliminate the vulnerability.

The CVSS base score of 4.3 indicates a moderate risk, and the vulnerability is not listed in the CISA KEV catalog. EPSS data is unavailable, but the attack requires an authenticated session with a developer role and access to the project’s API. Accordingly, the exploit is likely to be limited to users who already have legitimate access, but a malicious developer can misconfigure a protected environment, causing unintended deployments or environment mutilation. The vulnerability is therefore a medium‑risk concern that should be addressed promptly.