Threats tagged 'bit-gitlab-2026-16255'

An incorrect authorization vulnerability in GitLab EE versions from 12.0 up to but not including 19.3.6, 19.4 up to 19.4.3, and 19.5 up to 19.5.1 allowed authenticated users to grant or accept project and group memberships outside the identity provider's control when the instance-wide SAML or LDAP membership lock was enabled. This was due to incomplete enforcement of the membership lock on requests created before the lock was enabled. The issue has been fixed in versions 19.3.6, 19.4.3, and 19.5.1.