Description

GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with reporter-role permissions who authored a merge request could have reset merge request approval rules due to improper authorization checks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-08-26T14:17:16.570Z",
  "pubdate": "2026-08-26T14:17:16.570Z",
  "executiveSummary": "This vulnerability is an improper authorization check flaw affecting GitLab EE that permits unauthorized modification of merge request approval rules.\nThe issue exists within the authorization logic governing merge request state management.\nAn authenticated user assigned the reporter-role, provided they are the original author of the merge request, can exploit this flaw to reset established approval rules.\nThis impacts the integrity of the code review process, as it allows users to bypass mandatory approval gates enforced by project maintainers or security policies.\nThe vulnerability affects GitLab EE versions 13.1 through 19.1.6, 19.2 through 19.2.4, and 19.3.0.\nSuccessful exploitation requires the attacker to have at least reporter-role permissions and ownership of the target merge request.\nRisk implications include the potential for unauthorized code changes to be merged without the required peer or security reviews, undermining the security posture of the development lifecycle.",
  "technicalDetails": "The root cause of the vulnerability is an insufficient access control check within the GitLab EE merge request approval management logic. Specifically, the application failed to properly validate whether the user initiating a request to reset approval rules possessed the necessary elevated permissions, erroneously granting authorization based on the user's role as the merge request author rather than enforcing project-level administrative permissions.\nThe affected component is the internal API or controller responsible for processing merge request approval state updates. In a standard workflow, only users with sufficient project permissions (typically maintainer or owner) should be authorized to modify or reset mandatory approval rules. However, the logic allowed a bypass if the actor was the author of the request, even if their assigned role was limited to 'reporter'.\nThe attack flow proceeds as follows: First, an attacker with a reporter-role identifies a merge request they have authored. Second, the attacker interacts with the GitLab API or web interface endpoints designated for managing merge request approval state. Third, due to the faulty authorization check, the backend service fails to verify if the reporter-role user has the authority to reset these rules. Fourth, the application processes the request, effectively clearing any previously granted approvals or resetting the rules to a default state chosen by the attacker.\nThis exploitation requires the attacker to be authenticated to the GitLab EE instance. The requirement for the attacker to be the author of the merge request acts as a functional constraint, though in many development environments, reporters are frequently encouraged to create and manage their own merge requests, increasing the attack surface.\nThe impact of this vulnerability is significant in high-security environments where approval rules are used to enforce separation of duties, security audits, or mandatory code reviews. By resetting approval rules, an attacker can circumvent these controls, allowing for the potential injection of unauthorized or malicious code into a protected branch. The vulnerability affects GitLab EE versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1."
}