---
id: "CVE-2026-103515"
kind: "vulnerability"
aliases: ["CVE-2026-103515"]
title: "GitLab EE: group owner re-enables locked AI data egress to third party"
severity: "low"
cvss: 2.7
epss: 0.00232
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["gitlab", "gitlab-duo", "infrastructure", "self-hosted"]
not_affected_if: ["default-config", "no-duo-admin-lock"]
published_at: "2026-10-22T01:16:57+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T04:47:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103515", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-103515", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# GitLab EE: group owner re-enables locked AI data egress to third party

GitLab EE lets a group Owner re-enable AI-backed data egress to a third-party service for a group and its subprojects after an instance administrator had locked Duo availability for that group. An attacker with Owner rights can send that group's data to an outside AI service despite the admin lock.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the GitLab version with `gitlab-rake gitlab:env:info` or the GitLab UI version page and compare to the fixed releases.
- In the Admin area, review whether GitLab Duo is locked for any group and whether group Owners changed Duo settings afterward.

## Fix

- Upgrade GitLab EE to `19.3.6`, `19.4.3`, or `19.5.1` depending on the branch you run.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103515
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-103515

## From the sources

GitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when an instance administrator locked a group's Duo availability, an authenticated user with group Owner permissions could have re-enabled AI-backed data egress to a third-party service for that group and its descendant projects, due to insufficient granularity of the admin-lock enforcement controls.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_