GitLab Enterprise Edition contains a weakness that permits an authenticated user with limited permissions to alter project CI/CD deployment rollback settings. The vulnerability arises from insufficient access control checks when applying configuration changes, allowing an unauthorized modification of critical deployment parameters. This could enable a malicious actor to influence system behavior or disrupt operations by rolling back or altering deployments without proper approval.

The impacted product is GitLab Enterprise Edition. Versions from 13.6 through 19.2.7, 19.3.0 to 19.3.4, and 19.4.0 to 19.4.1 are vulnerable. All other releases, including 19.2.8, 19.3.5, 19.4.2 and later, contain the patch.

The CVSS score of 2.7 indicates low severity. The EPSS score is not available, so publicly known exploitation data is lacking. The vulnerability is not in the CISA KEV catalog. Attack requires an authenticated session with limited permissions, likely restricted to internal users. While the CVSS description does not explicitly state attack complexity, it is inferred that the complexity is low because the vulnerability relies on already authenticated access; therefore exploitation remains unlikely under these conditions.