What is the CVSS score of CVE-2026-6883?

CVE-2026-6883 has a CVSS 3.1 base score of 2.6 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-6883?

Yes, a patch is available for CVE-2026-6883. Update the affected software to the latest version immediately.

GitLab EE CVE-2026-6883

EUVD-2026-30237 LOW

Missing Authorization (CWE-862)

2026-05-14 cve@gitlab.com

GHSA-j7c9-9cr2-9pq2

Authentication Bypass Gitlab

2.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.6 LOW

AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 12:54 vuln.today

Patch available

May 14, 2026 - 07:16 EUVD

DescriptionCVE.org

GitLab has remediated an issue in GitLab EE affecting all versions from 15.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to bypass merge request approval requirements due to improper cleanup of orphaned policy records.

AnalysisAI

Merge request approval bypass in GitLab Enterprise Edition allows authenticated users to circumvent policy-enforced approval gates due to improper cleanup of orphaned approval policy records. Affected are all GitLab EE deployments running versions from 15.7 up to (but not including) 18.9.7, 18.10.6, and 18.11.3. No public exploit exists and no active exploitation has been confirmed; however, the integrity impact carries meaningful governance risk in regulated environments where merge approval policies serve as a compliance or change-management control.

Technical ContextAI

GitLab Enterprise Edition implements merge request approval policies - rules requiring sign-off from designated reviewers before code can be merged. CWE-862 (Missing Authorization) is the root cause class: the application fails to enforce authorization checks in a specific state created by orphaned policy records. Orphaned records are residual database entries left behind when approval policies are deleted, restructured, or detached from their parent project or group without proper cascading cleanup. These stale records can persist in a state that misleads the authorization check logic into treating a merge request as already-approved or exempt. The CPE strings (cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*) confirm the vulnerability is exclusive to the Enterprise Edition, which is the only tier that supports advanced approval policy features; GitLab Community Edition is not affected.

RemediationAI

The primary fix is upgrading GitLab EE to a patched release: 18.11.3 or later for the 18.11 series, 18.10.6 or later for the 18.10 series, or 18.9.7 or later for those on older supported branches. The vendor patch release is documented at https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/. No specific workaround is described in available references. If immediate upgrade is not feasible, a compensating control is to temporarily restrict who can open or approve merge requests on sensitive projects by tightening group membership to trusted users only, reducing the pool of authenticated low-privilege accounts that could trigger the bypass. This trade-off increases merge request friction and may slow development workflows. Organizations using approval policies as compliance controls should consider freezing merges on regulated projects until the patch is applied, or manually auditing recent merges for unauthorized approvals.