An incorrect authorization check in GitLab Community Edition and Enterprise Edition permits an authenticated user with developer permissions to bypass package protection rules and overwrite protected Maven package metadata. This flaw could allow the attacker to alter package metadata, compromising the integrity and authenticity of artifacts distributed through the repository. The weakness is classified as CWE‑863: Improper Authorization.

Affected products include GitLab Community Edition and GitLab Enterprise Edition versions 17.11 up to, but not including, 18.11.6; 19.0 up to 19.0.3; and 19.1 up to 19.1.1. The vulnerability applies to all GitLab instances running these versions, regardless of deployment environment, as long as package management services are enabled and Maven packages are protected.

The CVSS score of 4.3 indicates medium severity, and no EPSS score is available, suggesting limited public exploitation evidence. The vulnerability is not listed in CISA KEV, indicating no known high‑profile incidents. However, any user with developer-level access can exploit the flaw, and developers are often granted to many contributors, making it a plausible risk when broad developer permissions exist. The likely attack vector is authenticated developer actions within GitLab that involve uploading or managing package metadata.