CVE-2026-92528: Incorrect Authorization in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 16.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to approve a merge request despite having contributed commits to it, due to improper identity resolution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.2.8 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.3.5 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.4.2
Event History
Frequently Asked Questions
Which GitLab EE releases contain the fix?
Upgrade to GitLab EE 19.2.8, 19.3.5, or 19.4.2 or later, depending on the release branch in use. Affected versions begin at 16.11 and include releases before those patch versions.
What access and conditions are required for exploitation?
An attacker must be an authenticated user with low privileges. Exploitation requires the relevant conditions for improper identity resolution and involves approving a merge request to which the user has contributed commits.
Does exploitation require user interaction?
No user interaction is required. The vulnerability is network-accessible, although exploitation has high attack complexity.
Is GitLab Community Edition identified as affected?
The affected software listed is GitLab EE. The provided information does not identify GitLab Community Edition as affected.