CVEvulnerability
CVE-2026-7487
3.5 LOW
Official page ↗
- Status
- Analyzed
- Published
- 2026-08-26
- Last modified
- 2026-08-31
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 3.5 LOW — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
- Weaknesses
- CWE-1280
Description
GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with reporter-role permissions who authored a merge request could have reset merge request approval rules due to improper authorization checks.
Affected configurations
• gitlab gitlab (>= 13.1.0 < 19.1.7)
• gitlab gitlab (>= 19.2.0 < 19.2.5)
• gitlab gitlab 19.3.0
Related
Weakness · CWE (1)
- CWE-1280 Access Control Check Implemented After Asset is Accessed weakness
References
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-1-released/ Release Notes, Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/work_items/598657 Issue Tracking, Permissions Required
- https://hackerone.com/reports/3669140 Permissions Required, Third Party Advisory