Executive brief
GitLab Enterprise Edition contains an authorization flaw that allows authenticated users with reporter-level permissions who authored a merge request to reset approval rules on that request. This could allow a developer to bypass code review requirements and merge changes without proper oversight, potentially introducing unreviewed or unauthorized code into production.
Technical details
The vulnerability is an improper authorization (CWE-285) issue in GitLab EE's merge request approval rules functionality. An authenticated user with reporter-role permissions who is the author of a merge request can reset merge request approval rules due to insufficient authorization checks in the approval rules reset endpoint. The attack requires network access and valid authentication credentials; no special user interaction is required. An attacker can exploit this to bypass code review policies and approval requirements on their own merge requests. The vulnerability affects versions 13.1 through 19.1.6, 19.2.0 through 19.2.4, and 19.3.0 through 19.3.0, with patches released in versions 19.1.7, 19.2.5, and 19.3.1.
Affected products
- GitLab GitLab EE 13.1 before 19.1.7, 19.2 before 19.2.5, 19.3 before 19.3.1
Timeline
- 2026-08-26: disclosed: Security advisory published
- 2026-08-26: patched: Patches released in GitLab EE 19.1.7, 19.2.5, and 19.3.1