CVE-2026-103515 LOW 2.7
Published: 2026-10-22 01:16:57 UTC · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Categories: Containers / DevOps
GitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when an instance administrator locked a group's Duo availability, an authenticated user with group Owner permissions could have re-enabled AI-backed data egress to a third-party service for that group and its descendant projects, due to insufficient granularity of the admin-lock enforcement controls.
Weakness: CWE-863
Affected products
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*cpe:2.3:a:gitlab:gitlab:19.5.0:*:*:*:enterprise:*:*:*