Executive brief
GitLab Enterprise Edition, a platform used for software development and version control, contained a flaw that allowed certain users to bypass security rules. Specifically, an authorized developer could remove 'code owner' approval requirements from merge requests, which are intended to ensure that sensitive code changes are reviewed by designated experts. This could lead to unauthorized code changes being merged into a project without the required oversight.
Technical details
An improper access control vulnerability (CWE-639) exists in GitLab EE affecting versions 11.10 through 18.11.3. The flaw allows an authenticated attacker with 'Developer' role permissions to bypass intended restrictions and remove code owner approval rules from merge requests under specific conditions. This bypass occurs due to insufficient validation of user-controlled keys or parameters during the modification of merge request rules. An attacker can exploit this over the network to circumvent mandatory code reviews. GitLab has released patches in versions 18.9.7, 18.10.6, and 18.11.3 to address this issue.
Affected products
- GitLab GitLab Enterprise Edition (EE) 11.10 to < 18.9.7, 18.10 to < 18.10.6, 18.11 to < 18.11.3
Timeline
- 2026-05-13: patched: GitLab released versions 18.9.7, 18.10.6, and 18.11.3.
- 2026-05-14: disclosed: CVE-2026-6063 published.