CVE-2026-16627

This is a narrow but high-impact privilege escalation in GitLab's CI job modal rendering. Versions 19.2 through 19.2.2 contain improper HTML sanitization that allows an authenticated developer with project access to escalate to maintainer or owner permissions through crafted content in CI job outputs, variable expansions, or artifacts. The narrow version band is significant—it strongly suggests a regression introduced by new content flows in 19.2, not a dormant flaw. The modal rendering layer received expanded CI content streams (job logs, variable interpolation, merge request context) without corresponding security review of the new trust boundary. The 'certain conditions' qualifier indicates context-dependent exploitation—likely requiring specific job configurations or content types—but this should not narrow your threat assessment. The real issue is architectural: CI/CD content was historically treated as developer-controlled operational output, not user-facing content requiring sanitization. When GitLab exposed that content through interactive modals built for UX, the sanitization layer did not follow. The blast radius matters: maintainer access controls CI/CD secrets, production deployment triggers, and protected branch rules. If your organization runs GitLab 19.2.x, prioritize this patch immediately. For defense-in-depth, audit other modal-adjacent features that render CI content—similar implicit trust assumptions likely persist elsewhere in the codebase. The fix in 19.2.2 almost certainly adds explicit sanitization at the modal boundary, but without formalizing the trust contract for modal content sources, the underlying assumption will resurface in future releases touching CI routing.

Reviewed through automated stages and approved by a human before publication.