GitLab exposes an authorization flaw that allows an authenticated user possessing a project‑scoped fine‑grained Personal Access Token to change integration settings belonging to a group that is outside the token’s intended scope. The flaw stems from improper authorization checks that fail to enforce group boundaries when updating integration configurations. As a result, an attacker can alter, replace, or delete integrations for unrelated groups, potentially exposing data or disrupting automated workflows.

This vulnerability affects GitLab Community and Enterprise Editions released from version 19.1 up to but not including 19.2.8, as well as versions 19.3 through 19.3.4, and 19.4 through 19.4.1. All GitLab distributions are impacted when an authenticated session with a project‑scoped fine‑grained Personal Access Token is used.

The CVSS v3 score of 4.2 indicates a medium impact; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must have a valid authenticated session with a fine‑grained Personal Access Token and must be able to identify and target an integration in another group. The exploitation path involves calling the integration update API with the token, which then bypasses group‑level checks. Consequently, while the vulnerability is not exploitable from the open internet without authentication, it can be leveraged by malicious insiders or compromised tokens to modify integrations outside their scope.