CVE-2026-6552: GitLab EE Group SAML Account Takeover Vulnerability

Technical summary

CVE-2026-6552 is a privilege escalation and account takeover vulnerability stemming from improper authorization controls in GitLab EE's Group SAML identity management implementation. The flaw allows an authenticated user holding Owner role within a group to manipulate SAML identity mappings or authentication flows to assume control of another group member's account. The attack surface is limited to users with existing group Owner privileges, but the impact is severe—successful exploitation results in complete account compromise. The vulnerability is classified as CWE-639 (Authorization Through User-Controlled Key), indicating the system fails to properly restrict access to identity binding operations.

Business impact

Account takeover of any group member represents a critical data confidentiality and integrity risk. Attackers with compromised Owner accounts could exfiltrate proprietary code, modify repositories, inject malicious commits, alter CI/CD pipelines, or escalate further into connected systems. In regulated environments, unauthorized account access may trigger compliance violations and breach notification obligations. Organizations using GitLab EE for multi-tenant projects or with strict access controls should prioritize remediation to prevent insider threat escalation and social engineering attacks leveraging hijacked identities.

Affected systems

GitLab Enterprise Edition versions 15.5 through 18.10.7, 18.11.0 through 18.11.4, and 19.0.0 through 19.0.1 are vulnerable. Self-managed and SaaS deployments of GitLab EE within these version ranges require immediate patching. GitLab Community Edition is not affected. The vulnerability requires the attacker to already possess Owner role in a group, limiting the population of exploitable accounts but not eliminating risk in organizations with delegated group administration.

Exploitability

Exploitability is moderate in difficulty but high in impact. An attacker must first obtain or already hold Owner role within a targeted group—a position not trivially granted but plausible in large organizations with decentralized access management. Once positioned, the SAML identity manipulation can be executed remotely without additional user interaction. The attack does not require network access to external systems or complex technical setup. However, the requirement for pre-existing elevated privileges prevents mass exploitation of the vulnerability as an unauthenticated attack vector.

Remediation

Upgrade to GitLab 18.10.8, 18.11.5, or 19.0.2 or later depending on your release branch. GitLab has addressed the authorization logic in Group SAML identity management to enforce proper access controls. All patches should be applied during a maintenance window to ensure service availability. Verify the patch is applied by checking version numbers in the GitLab admin interface. If immediate patching is not feasible, restrict group Owner privileges to trusted administrators and audit SAML identity bindings for unauthorized modifications.

Patch guidance

GitLab has released patched versions across three supported release trains: apply version 18.10.8 or later for the 18.10 branch, 18.11.5 or later for 18.11, or 19.0.2 or later for the 19.x branch. Consult GitLab's official security advisory and release notes to confirm patch contents and any configuration changes required post-upgrade. Test patches in a staging environment first, particularly if your deployment includes custom SAML configurations or identity federation rules. Upgrades within a minor version (e.g., 18.11.4 to 18.11.5) are typically low-risk and can be prioritized for rapid deployment.

Detection guidance

Monitor GitLab audit logs for unexpected changes to SAML identity mappings, group member roles, or authentication configurations initiated by Owner-role users. Track API calls to group identity endpoints, particularly PATCH or PUT operations modifying group member associations. Alert on suspicious account access patterns—logins from unusual geographies or devices shortly after SAML configuration changes may indicate account takeover. Review Group Owner role assignments regularly and disable unused Owner accounts. In SIEM systems, correlate SAML configuration changes with subsequent account access anomalies to identify potential exploitation chains.

Why prioritize this

This vulnerability merits immediate prioritization due to its HIGH severity rating (CVSS 8.7), direct path to account takeover, and wide version range affected. The impact—full account compromise—is among the most damaging outcomes in identity management. Although exploitability requires existing Owner privileges, this is a credible threat in organizations with delegated group administration. Rapid patching prevents both insider threat escalation and potential external access if Owner accounts are compromised through credential theft or social engineering elsewhere. The fact that patches are already available removes deployment friction.

Risk score, explained

The CVSS 3.1 score of 8.7 (HIGH) reflects network-exploitable access (AV:N), low attack complexity (AC:L), and high privilege requirements (PR:H). The scoring emphasizes high confidentiality and integrity impact (C:H/I:H) with no availability impact. While the privilege requirement limits the attack surface, the severity is driven by the scope change (S:C)—a single compromised group Owner can impact the confidentiality and integrity of any group member's account and associated data. This positioning makes it a top-tier vulnerability for most GitLab deployments.

Frequently asked questions