Insufficient Admin Lock Enforcement in GitLab Affecting Data Security
CVE-2026-103515

2.7LOW

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
21 October 2026

What is CVE-2026-103515?

A vulnerability exists in GitLab EE that allows authenticated users with Owner permissions to bypass admin locks on Duo availability settings. This can lead to the unauthorized re-enabling of AI-backed data egress to third-party services for the affected group and its descendant projects. The issue arises due to a lack of sufficient granularity in the admin lock enforcement controls, posing significant risks to group data security.

Affected Version(s)

GitLab 19.2 < 19.3.6

GitLab 19.4 < 19.4.3

GitLab 19.5 < 19.5.1

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/631564
https://hackerone.com/reports/3871692
technical-descriptionexploitpermissions-required
https://docs.gitlab.com/releases/patches/patch-release-gi...

CVSS V3.1

Score:
2.7
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks [3nvz](https://hackerone.com/3nvz) for reporting this vulnerability through our HackerOne bug bounty program
.