What is the CVSS score of EUVD-2026-30223?

EUVD-2026-30223 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-30223?

Yes, a patch is available for EUVD-2026-30223. Update the affected software to the latest version immediately.

GitLab EE EUVD-2026-30223

| CVE-2026-2900 LOW

Missing Authorization (CWE-862)

2026-05-14 cve@gitlab.com

GHSA-8xwh-m77v-v26p

Authentication Bypass Gitlab

2.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 12:54 vuln.today

Patch available

May 14, 2026 - 07:01 EUVD

DescriptionCVE.org

GitLab has remediated an issue in GitLab EE affecting all versions from 16.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that when instance-level approval rule editing prevention was enabled, could have allowed an authenticated user with Maintainer permissions to modify or delete project approval rules due to missing authorization checks.

AnalysisAI

GitLab Enterprise Edition's instance-level approval rule editing prevention control can be bypassed by authenticated Maintainer-level users due to missing server-side authorization checks (CWE-862). Affected are all GitLab EE versions from 16.10 through before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3. An attacker holding Maintainer permissions can modify or delete project approval rules even when an administrator has explicitly enabled the instance-level restriction designed to prevent such changes, undermining the integrity of merge request approval workflows. No public exploit identified at time of analysis, and EPSS is at the 1st percentile, indicating negligible opportunistic exploitation risk.

Technical ContextAI

GitLab EE includes an instance-level administrative control that is intended to lock down project-level approval rule editing, preventing even high-privilege project users such as Maintainers from altering merge request approval requirements after an administrator sets them. The vulnerability is rooted in CWE-862 (Missing Authorization): when a Maintainer submits a request to modify or delete a project approval rule, the server fails to verify whether the instance-level prevention flag is active before processing the action. The CPE string cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* confirms this is exclusive to the Enterprise Edition, covering a wide version band from 16.10 onward. The CVSS vector AV:N/AC:L/PR:H/UI:N reflects a network-accessible API endpoint that requires no user interaction but does require the attacker to already hold high-level project privileges. The missing check is an authorization bypass rather than an authentication bypass despite the tag, as authenticated sessions are still required.

RemediationAI

GitLab has released patched versions that resolve this missing authorization check. Administrators should upgrade GitLab EE to version 18.9.7, 18.10.6, or 18.11.3 depending on their current release track, as documented in the official patch release blog at https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/. If immediate upgrade is not possible, a compensating control is to review and reduce the Maintainer-role membership on projects where approval rule integrity is critical - specifically removing the Maintainer role from untrusted users, since the vulnerability requires Maintainer-level access. Note that downgrading Maintainer accounts to Developer will limit their ability to manage other project settings as a side effect. Disabling the instance-level approval rule editing prevention feature is not a recommended workaround, as it removes the intended policy control entirely. The HackerOne report at https://hackerone.com/reports/3561092 may contain additional technical detail once disclosed.