Executive brief
GitLab, a platform used for software development and version control, has addressed a security flaw that could allow certain users to modify code changes they should not have access to. Specifically, an authenticated user with 'developer' permissions could bypass security restrictions to modify hidden merge requests. This could lead to unauthorized changes in software projects, potentially impacting the integrity of the codebase.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in GitLab CE/EE versions 15.10 through 19.0.2. The flaw resides in the authorization enforcement logic for merge requests, where the system fails to properly restrict access to 'hidden' merge requests. An authenticated attacker with developer-level permissions can exploit this over the network to modify merge requests that should be restricted or invisible to them. This bypasses intended access controls but does not require user interaction. GitLab has released patches in versions 18.10.8, 18.11.5, and 19.0.2 to address this issue.
Affected products
- GitLab GitLab Community Edition (CE) 15.10 to 18.10.8, 18.11 to 18.11.5, 19.0 to 19.0.2
- GitLab GitLab Enterprise Edition (EE) 15.10 to 18.10.8, 18.11 to 18.11.5, 19.0 to 19.0.2
Timeline
- 2026-06-10: patched: GitLab released versions 18.10.8, 18.11.5, and 19.0.2
- 2026-06-11: disclosed: NVD publication date