PT-2026-40871 · Gitlab · Gitlab Ce/Ee

Published 2026-05-14 · Updated 2026-05-18 · CVE-2026-6063

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions GitLab EE versions 11.10 through 18.9.6 GitLab EE versions 18.10 through 18.10.5 GitLab EE versions 18.11 through 18.11.2

Description Improper access control allows an authenticated user with developer-role permissions to remove code owner approval rules from merge requests under certain conditions.

Recommendations Update to version 18.9.7 Update to version 18.10.6 Update to version 18.11.3

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

BDU:2026-07021

BIT-GITLAB-2026-6063

CVE-2026-6063

Affected Products

Gitlab Ce/Ee

References · 10

• 🔥 https://hackerone.com/reports/3649087 · Exploit
• https://cve.org/CVERecord?id=CVE-2026-6063 · Security Note
• https://ubuntu.com/security/CVE-2026-6063 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-6063 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-6063 · Security Note
• https://bdu.fstec.ru/vul/2026-07021 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2026-6063 · Vendor Advisory
• https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released · Note
• https://t.me/CVEtracker/53742 · Telegram Post
• https://gitlab.com/gitlab-org/gitlab/-/work_items/596332 · Note