CVE-2026-6552: Authorization Bypass Through User-Controlled Key in GitLab

Synopsis

An authorization bypass vulnerability in GitLab EE's Group SAML identity management allows an authenticated attacker to take over another group member's account. The vulnerability is reachable over the network and requires no victim interaction, but the attacker must hold a group Owner role within the targeted GitLab group. Successful exploitation gives the attacker full control of the victim's GitLab account, enabling broad access to repositories, pipelines, and organization data. Patched-image rebuilds at versions 18.10.8, 18.11.5, and 19.0.2 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the GitLab instance over the network; there is no requirement for local or physical access.

• AuthenticationRequired

  The attacker must hold a group Owner role within the targeted GitLab group; any lower-privilege account is not sufficient.

• Victim interactionNot required

  No action is required from the victim account holder for exploitation to succeed.

• Attack complexityDetail

  The exploit is reliable and imposes no special race conditions or environmental dependencies once the attacker has the required group Owner privilege.

Blast Radius

• The attacker gains full control of the victim's GitLab account, including the ability to read and exfiltrate all repositories and sensitive project data accessible to that account.
• The attacker can push malicious code, modify CI/CD pipeline configurations, or inject supply-chain artifacts under the victim's identity.
• The attacker can leverage the compromised account to escalate further within the organization, inviting collaborators, modifying group settings, or accessing secrets stored in GitLab CI variables.