A vulnerability in GitLab CE/EE versions from 18.3 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 allows an authenticated user with an MCP-scoped token to perform actions beyond the intended scope due to improper authorization checks. This issue has been remediated in versions 19.2.7, 19.3.3, and 19.4.1. The vulnerability has a medium severity rating with a CVSS score of 5.4.