PT-2026-40860 · Gitlab · Gitlab Ce/Ee

CVE-2026-2900 · Published 2026-05-14 · Updated 2026-05-18

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions GitLab EE versions 16.10 through 18.9.6 GitLab EE versions 18.10 through 18.10.5 GitLab EE versions 18.11 through 18.11.2

Description An issue exists where missing authorization checks could allow an authenticated user with Maintainer permissions to modify or delete project approval rules when instance-level approval rule editing prevention is enabled.

Recommendations Update to version 18.9.7 Update to version 18.10.6 Update to version 18.11.3

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2026-07014

BIT-GITLAB-2026-2900

CVE-2026-2900

Affected Products

Gitlab Ce/Ee

References · 9

• 🔥 https://hackerone.com/reports/3561092 · Exploit
• https://cve.org/CVERecord?id=CVE-2026-2900 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2026-2900 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-2900 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-2900 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07014 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-2900 · Security Note
• https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released · Note
• https://gitlab.com/gitlab-org/gitlab/-/work_items/590983 · Note