CVE-2026-16255: 
GitLab 脆弱性分析と緩和策

CVE-2026-16255 is an Incorrect Authorization vulnerability in GitLab Enterprise Edition (EE) that allows authenticated users to bypass instance-wide SAML or LDAP membership lock controls. When the membership lock was enabled, users could still grant or accept project and group memberships outside the identity provider's control if the requests were created before the lock was enabled — due to incomplete enforcement of the policy. The vulnerability affects all GitLab EE versions from 12.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. It carries a CVSS v3.1 base score of 7.1 (High) per NVD, and 5.9 (Medium) per ENISA/GitLab's own scoring (GitLab Patch Release, ENISA EUVD).

The root cause is classified as CWE-863 (Incorrect Authorization). The flaw stems from incomplete enforcement of the instance-wide SAML or LDAP membership lock: membership requests or invitations created prior to the lock being enabled were not retroactively invalidated or blocked, allowing them to be accepted or granted after the lock was active. An authenticated user with low privileges could exploit this over the network without user interaction by leveraging pre-existing pending membership requests to gain access to projects or groups that should be restricted by the identity provider. No public proof-of-concept exploit code has been identified (GitLab Patch Release, ENISA EUVD).

Successful exploitation allows an authenticated user to gain unauthorized membership in GitLab projects and groups that should be governed exclusively by the organization's SAML or LDAP identity provider. This undermines access control policies enforced by the identity provider, potentially exposing sensitive source code, CI/CD pipelines, secrets, and other project resources to unauthorized users. The confidentiality impact is rated High, while integrity impact is Low and there is no availability impact, reflecting the risk of unauthorized data access rather than data destruction or service disruption (ENISA EUVD, GitLab Patch Release).

There is no evidence of active in-the-wild exploitation or publicly available proof-of-concept code as of the time of reporting. The EPSS score is approximately 0.0021 (0.21%), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. NVD's SSVC assessment classifies the vulnerability as non-automatable with partial technical impact (ENISA EUVD, GitLab Patch Release).

1. Identify target instance: Locate a GitLab EE instance with instance-wide SAML or LDAP membership lock enabled, running a vulnerable version (12.0 through 19.3.5, 19.4.0–19.4.2, or 19.5.0).
2. Authenticate: Log in to the GitLab instance with any valid low-privilege user account.
3. Leverage pre-lock membership requests: Identify or create project/group membership invitations or requests that were initiated before the membership lock was enabled (e.g., pending group invitations or join requests).
4. Accept or grant membership: Use the GitLab UI or API to accept or approve the pending membership request, which the system fails to block due to incomplete enforcement of the lock on pre-existing requests.
5. Gain unauthorized access: The user now holds membership in a project or group outside the identity provider's control, granting access to associated repositories, pipelines, and secrets (GitLab Patch Release, ENISA EUVD).

• Logs: GitLab application logs showing membership acceptance or grant events for users who should be restricted by SAML/LDAP lock policies; audit log entries for group or project membership changes occurring after the membership lock was enabled.
• GitLab Audit Events: Unexpected member_created or member_updated audit events in the GitLab admin audit log for groups or projects under identity provider control, particularly from users not provisioned through the IdP.
• Admin Panel: Presence of group or project members who are not managed by the configured SAML or LDAP identity provider, discoverable via the GitLab admin Members management interface.

GitLab has released patched versions: 19.3.6, 19.4.3, and 19.5.1. Organizations should upgrade to the appropriate fixed version immediately. As an interim measure, administrators should audit all existing project and group memberships to identify any unauthorized access granted through this vulnerability, and revoke memberships for users not provisioned by the identity provider. Ensuring that SAML or LDAP membership lock is correctly configured and reviewing pending membership requests before enabling the lock can reduce residual risk (GitLab Patch Release, ENISA EUVD).

The vulnerability received coverage from several security news outlets including Heise, CyberSecurityNews, and GBHackers, primarily in the context of GitLab's broader patch release that also addressed a critical RCE vulnerability (CVE-2026-110264, CVSS 10.0), which drew more attention than CVE-2026-16255 itself. Security community discussion on Mastodon/infosec.exchange noted the patch release. No significant independent researcher commentary specific to this CVE has been identified (Heise, CyberSecurityNews).