CVE-2026-15423 is an authorization bypass vulnerability in GitLab Community and Enterprise Editions affecting versions from 19.0 prior to 19.0.6, 19.1 prior to 19.1.4, and 19.2 prior to 19.2.2. Under certain conditions, an authenticated user with developer-role permissions could execute CI/CD pipelines on protected branches without possessing the necessary push permissions. The root cause is improper authorization checks during pipeline reference validation. This vulnerability is classified under CWE-863 (Incorrect Authorization).

An attacker with developer-level access could bypass branch protection controls to run CI/CD pipelines on protected branches, potentially leading to unauthorized code execution or changes in the CI/CD process. The CVSS v3.1 score is 8.5 (High), reflecting network attack vector, low attack complexity, privileges required at the developer level, no user interaction, scope change, low confidentiality impact, high integrity impact, and no availability impact.

GitLab has officially remediated this vulnerability in versions 19.0.6, 19.1.4, and 19.2.2. Users should upgrade to at least these versions to mitigate the issue. Since this is an on-premises product, patching is required by the user. No known exploits are reported in the wild at this time.