Threats tagged 'bit-gitlab-2026-103515'

GitLab EE versions 19.2 up to but not including 19.3.6, 19.4 up to 19.4.3, and 19.5 up to 19.5.1 contain an authorization flaw. This flaw allows an authenticated user with group Owner permissions to bypass an instance administrator's lock on a group's Duo availability and re-enable AI-backed data egress to a third-party service for that group and its descendant projects. The issue arises from insufficient granularity in the enforcement of admin-lock controls. GitLab has released fixes in versions 19.3.6, 19.4.3, and 19.5.1.