CVE-2026-14288: Use of Incorrectly-Resolved Name or Reference in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a required merge request approval policy on a protected branch due to improper access control during approval rule synchronization.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.3.6 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.4.3 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.5.1
Event History
Frequently Asked Questions
Which GitLab EE versions need remediation?
GitLab EE is affected from version 17.4 up to, but not including, 19.3.6; version 19.4 up to, but not including, 19.4.3; and version 19.5 up to, but not including, 19.5.1. Upgrade to 19.3.6, 19.4.3, 19.5.1, or a later applicable release.
What access would an attacker need?
The issue requires an authenticated attacker with low privileges. Exploitation also depends on unspecified conditions and has high attack complexity.
What is the potential impact?
An attacker could bypass a required merge request approval policy for a protected branch. The stated impact is limited to integrity; no confidentiality or availability impact is identified.