PT-2026-40860 · Gitlab · Gitlab

Published 2026-05-14 · Updated 2026-05-14 · CVE-2026-2900

NVD

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

GitLab has remediated an issue in GitLab EE affecting all versions from 16.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that when instance-level approval rule editing prevention was enabled, could have allowed an authenticated user with Maintainer permissions to modify or delete project approval rules due to missing authorization checks.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-2900

Affected Products

Gitlab

References · 4

• 🔥 https://hackerone.com/reports/3561092 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2900 · Security Note
• https://gitlab.com/gitlab-org/gitlab/-/work_items/590983 · Note
• https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released · Note