Database/Control plane, storage & DevOps
GitLab EE: a developer with group management permissions can escalate to broader system capabilities
Impact
A user holding the Developer role plus specific group management permissions can escalate privileges and gain unauthorized access to additional system capabilities. On a fleet where GitLab drives CI into the cluster, extra privilege in GitLab generally converts into control over which pipelines run, with which runners and which credentials - the practical risk is a tenant developer reaching projects, runner configuration or CI variables that belong to other teams. The advisory does not enumerate which capabilities are gained; treat it as an in-application privilege boundary failure rather than host compromise. Affects GitLab EE from 16.6 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1.
Who can reach it
An authenticated GitLab EE user with the Developer role and certain group management permissions, over the network. Requires an existing account with that standing - not anonymous.
What to do
Upgrade GitLab EE to 18.2.7, 18.3.3 or 18.4.1 (or later) and restart the services. Until then, review who holds group management permissions alongside Developer in shared groups. Patching touches only the GitLab host.
References
Related entries
- N-able N-central: Improper input validationCVE-2025-8876 · N-able N-centralHigh
- Grafana: symlink escape in plugin archive extraction gives remote code execution as the Grafana processCVE-2026-15815 · Grafana OSS / Enterprise (plugin archive extraction)High
- Kubeflow Training Operator (RHOAI overlay, trainjobs aggregated into the edit ClusterRole): The RHOAI overlayCVE-2026-18951 · Kubeflow Training Operator (RHOAI overlay, trainjobs aggregated into the edit ClusterRole)High
- NetApp ONTAP WebAuthn multi-factor authentication (Relying Party ID): An attacker who already has valid credentialsCVE-2026-22049 · NetApp ONTAP WebAuthn multi-factor authentication (Relying Party ID)High
- Jenkins: symlinks in tar archives let a job or agent write files anywhere the controller canCVE-2026-33001 · Jenkins controller (.tar/.tar.gz extraction, symlink handling)High
- Apache ActiveMQ: Improper input validation and code injection in the brokerCVE-2026-34197 · Apache ActiveMQHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.