GitLab has remediated multiple vulnerabilities affecting GitLab Community Edition (CE) and Enterprise Edition (EE). These vulnerabilities allow remote arbitrary code execution, data confidentiality breach, and security policy bypass. Affected versions include 19.2.x before 19.3.6, 19.4.x before 19.4.3, and 19.5.x before 19.5.1. One specific issue involves insufficient granularity of admin-lock enforcement controls for group Duo availability, allowing authenticated group Owners to re-enable AI-backed data egress to third-party services.
| Vendor | Product | Versions |
|---|---|---|
| GitLab | GitLab EE | 19.2, 19.4, 19.5 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| open source | gitlab | cert_advisory | 90% |
Loading…
Article reveals this is part of a multi-vulnerability advisory affecting both GitLab CE and EE with remote code execution and data confidentiality risks; severity upgraded from LOW to HIGH based on documented impact; product scope expanded to include Community Edition.
Added vendor (GitLab) and product (GitLab EE), extracted specific affected versions from version ranges, and identified patched versions.
Initial creation
