AI analysis
GitLab Community and Enterprise Editions contain a missing-authentication-enforcement flaw (CWE-306) in which, under certain conditions, an already-authenticated user can bypass SAML SSO sign-in restrictions and access the instance without going through SSO. The issue affects all versions from 18.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2, and is rated medium severity (CVSS 3.1: 5.4) with low confidentiality and integrity impact and no availability impact. An attacker with valid local credentials or tokens could use this to circumvent identity-provider-based access controls on self-managed instances where SAML SSO enforcement is expected. Only self-managed GitLab deployments that rely on SAML SSO restrictions are impacted; GitLab's SaaS offering is not affected. There is no known public proof of concept, the flaw is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported. Note that related press coverage of 'critical GitLab flaws' refers to other vulnerabilities fixed in the same release cycle (arbitrary file read, credential theft, code execution), not to this SSO bypass.
What to do: Upgrade self-managed GitLab CE/EE to 19.1.8, 19.2.6, or 19.3.2 (or later) as appropriate for your branch. Until patched, review audit and sign-in logs for users who accessed the instance without SSO, disable or restrict non-SSO authentication methods (password, PAT-based sessions) where feasible, and verify group-level SSO enforcement settings. GitLab.com users are not affected.
Affected
| GitLab Community Edition (CE) / Enterprise Edition (EE) | >=18.6, <19.1.8 |
| GitLab Community Edition (CE) / Enterprise Edition (EE) | >=19.2, <19.2.6 |
| GitLab Community Edition (CE) / Enterprise Edition (EE) | >=19.3, <19.3.2 |
Estimated exposure
large≈tens of thousands of internet-exposed self-managed GitLab hosts, with only the SAML-SSO-enforced subset truly vulnerable (clearly an estimate) — Public scan engines (Shodan/ZoomEye/FOFA) routinely show on the order of tens of thousands of internet-exposed self-managed GitLab instances, but the flaw only matters for the enterprise subset that enforces SAML SSO sign-in restrictions.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to bypass SAML SSO sign-in restrictions and authenticate without SSO due to missing authentication enforcement checks.