Authorization Bypass in GitLab Enterprise Edition by GitLab
CVE-2026-6883
2.6LOW
What is CVE-2026-6883?
A vulnerability exists in GitLab Enterprise Edition that could allow an authenticated user to bypass merge request approval requirements. This issue arises due to improper cleanup of orphaned policy records, which could lead to unauthorized approval of merge requests. Affected versions include GitLab EE from 15.7 up to but not including 18.9.7, and also includes versions 18.10 prior to 18.10.6 and 18.11 prior to 18.11.3. Users are advised to upgrade to the latest versions to mitigate potential risks.
Affected Version(s)
GitLab 15.7 < 18.9.7
GitLab 18.10 < 18.10.6
GitLab 18.11 < 18.11.3
References
CVSS V3.1
Score:
2.6
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
This vulnerability has been discovered internally by GitLab team member Alan (Maciej) Paruszewski