CVE-2026-16255 Overview
CVE-2026-16255 is an authorization flaw in GitLab Enterprise Edition (EE) that allows authenticated users to bypass instance-wide SAML or LDAP membership lock controls. The vulnerability affects GitLab EE versions from 12.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. When administrators enable the membership lock, GitLab fails to enforce the control on project and group membership requests that were created before the lock was activated. An authenticated user can grant or accept these pre-existing requests, placing membership outside the identity provider's control. The weakness is classified as [CWE-863] Incorrect Authorization.
Critical Impact
Authenticated users can bypass SAML/LDAP membership lock to grant or accept project and group membership outside the identity provider's governance, undermining centralized access control.
Affected Products
- GitLab EE versions 12.0 through 19.3.5
- GitLab EE versions 19.4 through 19.4.2
- GitLab EE version 19.5.0
Discovery Timeline
- 2026-10-22 - CVE-2026-16255 published to NVD
- 2026-10-22 - Last updated in NVD database
Technical Details for CVE-2026-16255
Vulnerability Analysis
The vulnerability resides in GitLab EE's enforcement logic for the instance-wide membership lock feature. The membership lock is designed to delegate authority over project and group membership to an external identity provider using SAML or LDAP. When enabled, GitLab should block in-application membership operations and defer those decisions to the identity provider.
The lock enforcement only applies to new requests created after activation. Existing access requests and invitations created before the administrator enabled the lock remain actionable within GitLab. Authenticated users with appropriate project or group roles can approve those pending requests, effectively adding members that the identity provider never authorized.
Root Cause
The root cause is incomplete authorization enforcement, consistent with [CWE-863]. GitLab's membership approval code path does not re-evaluate the lock state against the historical queue of pending requests. The authorization check assumes that all actionable requests were created under the current policy, which is not true after the lock is enabled retroactively.
Attack Vector
Exploitation requires an authenticated account with permissions to approve or accept project or group membership. The attack is network-reachable but relies on a race window: pending membership requests must exist in GitLab at the moment the administrator enables the lock. An attacker aware of pending invitations can approve or accept them after the lock is active, bypassing SAML or LDAP governance for those memberships.
No verified public exploit is available. See the HackerOne Report #3809350 and the GitLab Work Item #606479 for technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-16255
Indicators of Compromise
- Project or group members added through GitLab's UI or API after the instance-wide membership lock was enabled
- Membership approval events in audit logs that lack a corresponding SAML or LDAP provisioning event
- Access request acceptance events referencing request IDs created before the lock activation timestamp
Detection Strategies
- Compare GitLab membership audit events against identity provider provisioning logs to identify memberships without an upstream SAML or LDAP source
- Query the audit log for member_created and access_request_approved events after the lock enablement date and correlate request creation timestamps
- Flag user accounts that approved multiple pending membership requests shortly after membership lock enforcement was turned on
Monitoring Recommendations
- Enable and forward GitLab audit events to a centralized logging platform for correlation with identity provider logs
- Alert on any membership change event targeting groups or projects configured under SAML or LDAP membership lock
- Track administrative changes to the instance-wide membership lock setting and review all pending requests at the time of enablement
How to Mitigate CVE-2026-16255
Immediate Actions Required
- Upgrade GitLab EE to 19.3.6, 19.4.3, or 19.5.1 as applicable to the deployed branch
- Review all pending access requests and invitations before enabling the membership lock and reject any that are not identity provider authorized
- Audit current project and group membership against SAML or LDAP sources to identify unauthorized additions
Patch Information
GitLab addressed the issue in versions 19.3.6, 19.4.3, and 19.5.1. Full details are documented in the GitLab 19.5.1 Patch Release notes. Administrators running affected versions should apply the patches without delay.
Workarounds
- Clear or deny all pending project and group access requests before enabling the instance-wide membership lock
- Restrict project and group Owner and Maintainer roles to a minimal set of trusted accounts until patches are applied
- Temporarily disable project and group invitation workflows for users managed under SAML or LDAP until the upgrade is complete
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
