What is the CVSS score of CVE-2026-6063?

CVE-2026-6063 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-6063?

Yes, a patch is available for CVE-2026-6063. Update the affected software to the latest version immediately.

GitLab EE CVE-2026-6063

EUVD-2026-30233 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-14 cve@gitlab.com

GHSA-57q4-65mf-59mf

Authentication Bypass Gitlab

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:23 vuln.today

Patch available

May 14, 2026 - 07:01 EUVD

DescriptionCVE.org

GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that under certain conditions could have allowed an authenticated user with developer-role permissions to remove code owner approval rules from merge requests due to improper access control.

AnalysisAI

Improper access control in GitLab Enterprise Edition allows authenticated users holding only developer-role permissions to remove code owner approval rules from merge requests, effectively bypassing a critical gatekeeping control in the software development lifecycle. Affected are all GitLab EE versions from 11.10 up to (but not including) 18.9.7, 18.10.6, and 18.11.3. No public exploit or active exploitation has been identified at time of analysis; EPSS is 0.01% and CISA SSVC rates exploitation as none, indicating this is a low-urgency but organizationally meaningful integrity issue for teams relying on code owner rules for compliance or security enforcement.

Technical ContextAI

GitLab Enterprise Edition's code owner approval rules (configured via CODEOWNERS files) enforce that specific named reviewers must approve changes to designated file paths before a merge request can be merged. CWE-639 (Authorization Bypass Through User-Controlled Key) describes the root cause: the application fails to verify that the acting user is authorized to perform an operation on a specific object - in this case, an approval rule record - beyond just checking their general role. A developer-role user, who should only be able to create and contribute to merge requests, can supply or manipulate a reference to a code owner approval rule object in a way the backend does not properly gate, enabling deletion of that rule. The CPE confirms the exclusive scope: cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* - this issue does not affect GitLab Community Edition.

RemediationAI

GitLab has released patches in versions 18.9.7, 18.10.6, and 18.11.3 for their respective stable branches; upgrading to the appropriate fixed release is the primary and recommended remediation. The patch release advisory is at https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/. For self-managed GitLab EE instances that cannot be immediately upgraded, a compensating control is to audit and restrict developer-role memberships on projects where CODEOWNERS-based approval rules are critical, reducing the pool of users who could trigger this bypass. Additionally, GitLab EE administrators can enable 'Require all discussions to be resolved' and monitor merge request audit logs for unexpected removal of approval rules as a detective control. Note that restricting developer access may impact development velocity and should be weighed against the organizational risk posed by the approval rule bypass. GitLab.com (SaaS) deployments are managed by GitLab and were patched by the vendor.