{"id":"CVE-2026-103515","kind":"vulnerability","aliases":["CVE-2026-103515"],"related":[],"title":"GitLab EE: group owner re-enables locked AI data egress to third party","description":"GitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when an instance administrator locked a group's Duo availability, an authenticated user with group Owner permissions could have re-enabled AI-backed data egress to a third-party service for that group and its descendant projects, due to insufficient granularity of the admin-lock enforcement controls.","summary":"GitLab EE lets a group Owner re-enable AI-backed data egress to a third-party service for a group and its subprojects after an instance administrator had locked Duo availability for that group. An attacker with Owner rights can send that group's data to an outside AI service despite the admin lock.","severity":"low","cvss":2.7,"epss":0.00232,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gitlab","gitlab-duo","infrastructure","self-hosted"],"not_affected_if":["default-config","no-duo-admin-lock"],"how_to_check":"- Check the GitLab version with `gitlab-rake gitlab:env:info` or the GitLab UI version page and compare to the fixed releases.\n- In the Admin area, review whether GitLab Duo is locked for any group and whether group Owners changed Duo settings afterward.","fix":"- Upgrade GitLab EE to `19.3.6`, `19.4.3`, or `19.5.1` depending on the branch you run.","status":"open","published_at":"2026-10-22T01:16:57+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T04:47:59+00:00","updated_at":"2026-10-25T04:47:59+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:47:59Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade GitLab EE to `19.3.6`, `19.4.3`, or `19.5.1` depending on the branch you run.","reach":"network","title":"GitLab EE: group owner re-enables locked AI data egress to third party","impact":"medium","summary":"GitLab EE lets a group Owner re-enable AI-backed data egress to a third-party service for a group and its subprojects after an instance administrator had locked Duo availability for that group. An attacker with Owner rights can send that group's data to an outside AI service despite the admin lock.","category":"infrastructure","nicknames":[],"who_cares":["gitlab","self-hosted","gitlab-duo"],"confidence":0.6,"needs_auth":"yes","worst_case":"group code and data sent to third-party AI service","analyst_note":"","how_to_check":"- Check the GitLab version with `gitlab-rake gitlab:env:info` or the GitLab UI version page and compare to the fixed releases.\n- In the Admin area, review whether GitLab Duo is locked for any group and whether group Owners changed Duo settings afterward.","needs_analyst":false,"not_affected_if":["default-config","no-duo-admin-lock"],"who_is_affected":"Self-managed GitLab EE instances on 19.2 through 19.5.0 that use GitLab Duo and where an administrator locked Duo availability for some groups. GitLab.com and instances without Duo or without admin locks are less exposed, though the sources do not say explicitly. Teams that never lock Duo per group can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000626,"input_tokens":3426,"output_tokens":567,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-103515':17A,20A '-2026':16A,19A '19.2':98C '19.3.6':100C '19.4':101C '19.4.3':103C '19.5':105C '19.5.1':107C 'admin':84B,156C 'admin-lock':155C 'administr':58B,112C 'affect':94C 'ai':9A,39B,80B,132C 'ai-back':38B,131C 'attack':67B 'authent':120C 'avail':62B,118C 'back':40B,133C 'control':159C 'could':126C 'cve':15A,18A 'data':10A,41B,76B,134C 'descend':147C 'despit':82B 'due':149C 'duo':24B,61B,117C 'ee':2A,30B,93C 'egress':11A,42B,135C 'enabl':7A,37B,130C 'enforc':158C 'gitlab':1A,21B,23B,29B,86C,92C 'gitlab-duo':22B 'granular':152C 'group':3A,33B,51B,65B,74B,115C,123C,144C 'host':28B 'infrastructur':25B 'instanc':57B,111C 'insuffici':151C 'issu':90C 'let':31B 'lock':8A,60B,85B,113C,157C 'outsid':79B 'owner':4A,34B,69B,124C 'parti':14A,47B,140C 'permiss':125C 'project':148C 're':6A,36B,129C 're-en':5A,35B,128C 'remedi':88C 'right':70B 'self':27B 'self-host':26B 'send':72B 'servic':48B,81B,141C 'subproject':54B 'third':13A,46B,139C 'third-parti':45B,138C 'user':121C 'version':96C","nicknames":[],"mitigations":[],"who_affected":"Self-managed GitLab EE instances on 19.2 through 19.5.0 that use GitLab Duo and where an administrator locked Duo availability for some groups. GitLab.com and instances without Duo or without admin locks are less exposed, though the sources do not say explicitly. Teams that never lock Duo per group can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T01:16:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103515","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103515","severity":null,"published_at":"2026-10-22T01:16:57+00:00","modified_at":"2026-10-22T16:18:19+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-103515","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103515","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}