GitLab Enterprise Edition has an improper cleanup of scheduled pipeline execution policy records that, under certain conditions, could allow an authenticated user to run arbitrary CI/CD pipelines in a transferred project with a group’s new privileges, effectively bypassing the intended authorization checks for pipeline execution; this leads to potential unauthorized code execution or deployment of malicious artifacts.

All GitLab EE releases from 18.1 through 19.2.7, from 19.3.0 through 19.3.4, and from 19.4.0 through 19.4.1 are affected; the issue does not exist in versions 19.2.8, 19.3.5, 19.4.2 or later.

The CVSS score is 7.7, indicating a high severity of the flaw. EPSS data is not available, making the exact exploitation probability uncertain, and the vulnerability is not yet listed in the CISA KEV catalog. The attack requires a legitimate authenticated user with access to a transferred project; if the attacker can or schedule a pipeline, they may gain the ability to execute arbitrary code in the project’s environment.