Executive brief
GitLab Enterprise Edition, a platform used for software development and version control, contains a flaw in how it manages project approval rules. Under certain configurations, an authorized user with Maintainer privileges could bypass global restrictions to modify or delete these rules. This could allow a user to weaken security controls on a project, potentially bypassing required code reviews or compliance checks.
Technical details
A missing authorization check (CWE-862) in GitLab EE allows authenticated users with Maintainer-level permissions to bypass 'instance-level approval rule editing prevention' settings. When this global setting is enabled, Maintainers should be restricted from altering project-specific approval rules; however, due to the flaw, they can still modify or delete them via the network. This vulnerability affects GitLab EE versions 16.10 through 18.11.3. Patches have been released in versions 18.9.7, 18.10.6, and 18.11.3.
Affected products
- GitLab GitLab Enterprise Edition >=16.10, <18.9.7; 18.10, <18.10.6; 18.11, <18.11.3
Timeline
- 2026-05-13: patched: GitLab released versions 18.9.7, 18.10.6, and 18.11.3 to address the issue.
- 2026-05-14: disclosed: NVD published the CVE record.