CVE-2026-6063: Authorization Bypass Through User-Controlled Key in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that under certain conditions could have allowed an authenticated user with developer-role permissions to remove code owner approval rules from merge requests due to improper access control.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 18.9.7 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 18.10.6 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 18.11.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6063?
The severity of CVE-2026-6063 is classified as a high-severity vulnerability due to its potential for authorization bypass.
How do I fix CVE-2026-6063?
To fix CVE-2026-6063, upgrade to GitLab EE version 18.9.7, 18.10.6, or 18.11.3 or later.
Who is affected by CVE-2026-6063?
CVE-2026-6063 affects GitLab EE versions from 11.10 to prior releases of 18.9.7, 18.10.6, and 18.11.3.
What type of vulnerability is CVE-2026-6063?
CVE-2026-6063 is an authorization bypass vulnerability that can be exploited through user-controlled keys.
What are the potential impacts of exploiting CVE-2026-6063?
Exploiting CVE-2026-6063 could allow unauthorized access to features or data by authenticated users with developer-role permissions.