EUVD-2026-50481
GHSA-629v-rwjx-m485
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Race condition exploitation requires precise concurrent timing, warranting AC:H; PR:L reflects mandatory authentication; C:N and A:N match the integrity-only impact.
Primary rating from Vendor (GitLab).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to merge code into a protected branch without the required approvals due to a race condition in approval rule processing.
AnalysisAI
Approval bypass in GitLab Enterprise Edition allows authenticated users to merge code into protected branches without satisfying required approval rules by exploiting a race condition in the approval rule processing pipeline. Affected deployments span GitLab EE versions 17.0 through 19.2, with fixed releases available at 19.0.5, 19.1.3, and 19.2.1. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the integrity risk is significant in regulated environments where protected branch approvals serve as a primary code integrity control.
Technical ContextAI
The root cause is CWE-367 (Time-of-check Time-of-use Race Condition) within GitLab EE's merge request approval rule processing engine. Protected branches in GitLab EE enforce approval policies - requiring a configurable number of sign-offs from designated reviewers before a merge is permitted. The flaw exists in the window between the approval-state check and the actual merge commit operation: under certain concurrency conditions, a merge can be finalized before approval rules are fully evaluated and enforced, allowing the merge to proceed in an unapproved state. This is an enterprise-only feature (CE does not have configurable approval rules of this kind), scoped by CPE cpe:2.3:a:gitlab:gitlab across the version ranges identified by EUVD-2026-50481. The CVSS vector AV:N/PR:L correctly identifies this as a network-reachable, authenticated-user vulnerability with no confidentiality or availability impact - only integrity.
RemediationAI
Upgrade GitLab EE to version 19.0.5, 19.1.3, or 19.2.1 as appropriate for the installed minor version, per the vendor patch release at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/ and the internal tracking item at https://gitlab.com/gitlab-org/gitlab/-/work_items/597838. As a compensating control pending upgrade, administrators should reduce the set of users holding the Developer role or higher on repositories with sensitive protected branches, minimizing the pool of accounts that can create and act on merge requests - this reduces exposure but does not eliminate the race condition. Additionally, enabling audit logging for merge events on protected branches allows detection of anomalous merges lacking the expected approval trail. Note that no workaround fully closes the race condition; patching is the only complete remediation.
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. Rated critical severity (CVSS 10
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. Rated critical severity (CVSS 9.8)
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions star
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab af
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions sta
An issue was discovered in GitLab Omnibus 7.4 through 12.2.1. Rated critical severity (CVSS 9.8), this vulnerability is
An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today