CVE-2026-79708

GitLab Enterprise Edition (EE) contains an incorrect authorization flaw (CWE-863, insufficient scope validation) in its handling of security policy test pipelines. Under certain conditions, an authenticated user holding only the developer role in a group can trigger a policy test pipeline on projects within that group, and that pipeline runs outside its intended scope. As a result, the developer can read protected CI/CD variables that should be restricted to higher-privileged roles such as maintainers, potentially exposing deployment secrets, tokens, and credentials; the CVSS 8.5 score with a changed scope and high integrity impact reflects this escalation. Only GitLab EE (not Community Edition) is affected, across versions 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. There is no CISA KEV listing and no known public proof-of-concept, and GitLab reports it has remediated the issue in its latest EE security releases, so exploitation is not currently confirmed.

What to do: Upgrade GitLab EE to 19.3.2, 19.2.6, or 19.1.8 (matching your release track) or later; Community Edition is not affected. In the meantime, review audit and pipeline logs for policy test pipelines run by developer-role users and rotate any protected CI/CD variables (e.g., tokens and secrets) in groups where developers could have triggered such pipelines. Verify group membership and consider temporarily restricting who can run policy test pipelines in policy-enabled groups.