Executive brief
GitLab Enterprise Edition contains a flaw that could allow a user to bypass mandatory code review and approval requirements for software changes. This occurs because the system fails to properly clean up old security policy records, potentially allowing unauthorized code to be merged into protected repositories. This could lead to the introduction of unvetted code into production environments, undermining compliance and security controls.
Technical details
A missing authorization vulnerability (CWE-862) exists in GitLab EE due to the improper cleanup of orphaned policy records. An authenticated attacker with network access can exploit this flaw to bypass merge request approval requirements, though the attack complexity is high and requires user interaction. The vulnerability affects GitLab EE versions 15.7 through 18.11.3. Patches have been released in versions 18.9.7, 18.10.6, and 18.11.3 to remediate the issue by ensuring policy records are correctly handled.
Affected products
- GitLab GitLab Enterprise Edition (EE) 15.7 to < 18.9.7, 18.10 to < 18.10.6, 18.11 to < 18.11.3
Timeline
- 2026-05-13: patched: GitLab released versions 18.11.3, 18.10.6, and 18.9.7
- 2026-05-14: disclosed: CVE-2026-6883 published