Database/Control plane, storage & DevOps
GitLab: a developer removed from a project can still push commits via merge request collaboration settings
Impact
Offboarding is the control that makes a CI/CD system trustworthy. Missing authorization checks on merge request collaboration settings let a user who had developer role keep committing after their membership was revoked, so a departed contractor or a rotated-out account can still put code into a branch that pipelines build and deploy onto GPU nodes - container images, driver installers, cluster manifests. The exposure is integrity of the repository that feeds the fleet, not confidentiality. GitLab scores it 3.1 with high attack complexity, so it is a hardening upgrade rather than an emergency.
Who can reach it
Authenticated user who previously held developer-role permissions on the project, over the network. Requires the specific merge request collaboration condition GitLab does not fully describe.
What to do
Upgrade to GitLab 19.0.5, 19.1.3 or 19.2.1 (affected from 10.6) and restart the application - a routine GitLab upgrade, no node maintenance. Afterwards, audit recent commits and pipeline runs on projects where members were removed while merge requests were open.
References
Related entries
- GitLab: import authorization ignores the target namespace, letting a user-scoped token import into groupsCVE-2026-82632 · GitLab CE/EE project import (fine-grained PAT namespace authorization)Low
- Inspektor Gadget: malformed ELF crashes or exhausts memory in the privileged eBPF tracerCVE-2026-44778 · Inspektor Gadget uprobetracer USDT note parser (pkg/uprobetracer/usdt.go)Low
- GitLab: maintainers can delete package registry metadata that protection rules reserve for higher rolesCVE-2026-103549 · GitLab CE/EE package registry (package protection rules)Low
- Jenkins: project naming strategy config lets Overall/Manage holders instantiate admin-only typesCVE-2026-70430 · Jenkins core (project naming strategy configuration)Low
- GitLab EE: insufficient access control lets a limited user modify project CI/CD deployment rollback settingsCVE-2026-9268 · GitLab EE CI/CD deployment rollback settings (access control)Low
- Sunbird Power IQ 9.2.0 API: Error-based SQL injection through an outdated API endpoint with missing input validationCVE-2025-55703 · Sunbird Power IQ 9.2.0 APILow
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.