GitLab EE EUVD-2026-98216

Requires an authenticated GitLab EE account (PR:L) that has itself contributed commits to the target merge request, plus the specific 'certain conditions' under which improper identity resolution occurs - implying the environment must rely on merge-request approval rules that forbid contributors from approving their own changes (the four-eyes/separation-of-duties control being bypassed). Limiting factors: only GitLab Enterprise Edition is affected (not pure CE deployments), valid authenticated access is needed, high attack complexity (AC:H) indicates the identity-resolution edge case is not trivially triggerable, and the impact is confined to the review-governance process rather than direct data or system compromise.

This is a low-severity authorization flaw (vendor CVSS 3.1 base 4.2, CWE-863 Incorrect Authorization) and the combined signals point to a genuinely low real-world priority rather than an urgent one. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) shows network reach but requires an already-authenticated user (PR:L) and high attack complexity (AC:H), consistent with the description's qualifier that the bypass only occurs 'under certain conditions' via improper identity resolution. There is no CISA KEV listing, no public exploit code identified, and no EPSS score supplied in the input, so there is no evidence of active or probable exploitation. The primary impact is to the integrity of merge-request approval controls (separation-of-duties / four-eyes review), not system compromise; note the vendor assigned C:L but the described behavior - self-approving a merge request you contributed to - maps more naturally to an integrity-of-process issue than to confidentiality, a point worth verifying with GitLab. Net assessment: a defense-in-depth governance weakness for organizations that rely on GitLab approval rules for compliance, not a high-urgency remotely-exploitable vulnerability.

An authenticated GitLab EE user who has pushed commits to a merge request leverages an identity-resolution flaw to satisfy the approval requirement themselves, bypassing the rule that prevents contributors from approving their own changes. This lets a single insider merge code without the intended independent review, undermining separation-of-duties controls. No public proof-of-concept exploit has been identified at time of analysis.