Identity Resolution Flaw in GitLab EE Allows Improper Merge Request Approval
CVE-2026-92528

4.2MEDIUM

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
13 October 2026

What is CVE-2026-92528?

An improper identity resolution flaw has been identified in GitLab EE, affecting versions from 16.11 through various updates up to 19.4. This vulnerability can potentially permit an authenticated user to approve a merge request where they have contributed commits, creating significant risks in project integrity and collaboration workflows. Users are strongly advised to update to the latest versions to mitigate any potential exploitation.

Affected Version(s)

GitLab 16.11 < 19.2.8

GitLab 19.3 < 19.3.5

GitLab 19.4 < 19.4.2

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/606772
https://docs.gitlab.com/releases/patches/patch-release-gi...

CVSS V3.1

Score:
4.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This vulnerability has been discovered internally by GitLab team member Kenneth Chu
.