CVE-2026-7487: Access Control Check Implemented After Asset is Accessed in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with reporter-role permissions who authored a merge request could have reset merge request approval rules due to improper authorization checks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.1.7 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.2.5 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.3.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated GitLab EE user with the Reporter role who authored a merge request may be able to exploit it, but only under certain conditions.
Which deployments are affected?
GitLab EE versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 are affected.
What could exploitation allow?
The affected user could reset merge request approval rules. The reported impact is limited to integrity; no confidentiality or availability impact is specified.