GitLab contains an improper authorization check in the member management API that allows an authenticated user with a custom role granting member‑management permissions to demote or remove higher‑privileged group members. The flaw does not provide code execution or direct data access; it solely permits unauthorized modification of user privileges within a group, effectively enabling privilege escalation or weakening of existing access controls.

All GitLab Community Edition and Enterprise Edition releases from version 18.2 up to but not including 18.8.9, from 18.9 up to but not including 18.9.5, and from 18.10 up to but not including 18.10.3 are affected. The issue is specific to these GitLab deployments and does not apply to later patched releases.

The CVSS score of 2.7 indicates low severity. No publicly reported exploitation activity has been documented, and the vulnerability is not included in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires authentication and possession of a custom role with member‑management permissions, which may be available to insiders or compromised accounts. While the attack path is straightforward for a user with the necessary permissions, the overall risk remains limited compared to higher‑impact vulnerabilities.