## Summary
GitLab EE remediated an authorization flaw (CWE-639) that could allow an authenticated user to cause AI usage to be attributed to another namespace by supplying improperly authorized identity information in requests. GitLab recommends upgrading self-managed instances to the patched releases.
## Technical Details
- Root issue: improper authorization of identity information supplied in requests, leading to incorrect attribution of AI usage across namespaces.
- Affected scope: GitLab EE versions from 19.1 before 19.1.4 and from 19.2 before 19.2.2.
- Preconditions (per NVD text): authenticated user and “under certain conditions” where request identity information is accepted without proper authorization.
- CWE: CWE-639.
## Affected
- GitLab Enterprise Edition (EE):
- 19.1 < 19.1.4
- 19.2 < 19.2.2
- Patch releases announced by GitLab (self-managed): 19.2.2, 19.1.4, 19.0.6.
## Impact
- Cross-namespace AI usage attribution: AI activity could be recorded under a different namespace than the one that should be associated with the user’s actions.
- Likely security consequence: integrity impact (I:H in the provided CVSS vector) with additional impact on confidentiality/integrity/availability as reflected by the CVSS metrics (8.5, AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L).
## Mitigation
1. Upgrade self-managed GitLab installations to one of the patched versions: 19.2.2, 19.1.4, or 19.0.6 (as applicable to your release line).
2. Prioritize patching for GitLab EE instances in the affected ranges (19.1 < 19.1.4, 19.2 < 19.2.2).
3. Validate that your deployment is running the patched release (GitLab.com and dedicated customers are noted as already running patched versions).
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L
CWE-639