GitLab has an authorization flaw that lets an authenticated user with a narrow personal access token, scoped only for importing, create projects in group namespaces outside the token’s intended scope. This flaw allows the user to add projects to groups they normally cannot access, effectively granting elevated privileges for those import operations. The vulnerability is an improper authorization issue (CWE-863) and does not expose remote code execution or other higher‑level capabilities.

Affected products are GitLab Community Edition and Enterprise Edition. All releases from version 18.9 up to, but not including, 19.2.8, from 19.3 up to, but not including, 19.3.5, and from 19.4 up to, but not including, 19.4.2 are vulnerable. The vulnerability has been fixed in GitLab 19.2.8, 19.3.5, 19.4.2, and later releases.

The CVSS score of 3.1 indicates low severity; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited exploitation risk. However, the flaw can be abused if an attacker has a personal access token with import permissions; the likely attack vector is using the import API to target a group namespace beyond the user's allowed boundary. Since the impact is privilege escalation limited to project import, the overall risk remains low under typical configurations.