CVE-2026-103515Low· 2.7▾ SunlitGitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when an instance administrator locked a group's Duo availability, an authenticated user with gro…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 14.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
GitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when an instance administrator locked a group's Duo availability, an authenticated user with group Owner permissions could have re-enabled AI-backed data egress to a third-party service for that group and its descendant projects, due to insufficient granularity of the admin-lock enforcement controls.
GitLab >= 19.2 < 19.3.6GitLab >= 19.4 < 19.4.3GitLab >= 19.5 < 19.5.1Upgrade to versions 19.3.6, 19.4.3, 19.5.1 or above.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-16255Medium· 5.9Incorrect Authorization in GitLab
CVE-2026-12664Medium· 6.8Incorrect Authorization in GitLab
CVE-2026-15723High· 8.2Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in GitLab
CVE-2026-112326Low· 3.1Improper Cleanup on Thrown Exception in GitLab
CVE-2026-105777Medium· 4.3Insertion of Sensitive Information Into Sent Data in GitLab
CVE-2026-112378Medium· 4.3Use of Less Trusted Source in GitLab