The vulnerability is an authorization bypass in GitLab Enterprise Edition that may allow an authenticated user with developer role permissions, when foundational flows are enabled at the group level, to circumvent flow restrictions under certain conditions. This flaw, identified as CWE‑862, could enable the user to perform actions beyond the intended permissions, potentially affecting configuration or deployment processes. The impact is limited to unauthorized access to group‑level flow controls rather than system‑wide compromise or data exfiltration.

GitLab Enterprise Edition versions prior to 18.10.7, 18.11.4 and 19.0.1 are affected. Specifically, all releases from 18.7 through the last minor releases before the mentioned patch levels are vulnerable when foundational flows are enabled at the group level. The flaw is present in GitLab EE and not in other products.

With a CVSS score of 4.3, the vulnerability is considered moderate severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, indicating no known widespread exploitation. The likely attack vector requires an authenticated user with developer role who can configure group settings; therefore the threat is confined to environments where such users have access. While the flaw does not enable remote code execution, it permits unauthorized manipulation of flow restrictions, which could be leveraged for privilege escalation within the project.