Live › vulnerability › CVE-2026-14288
Go to dashboardGitLab EE versions from 17.4 up to (not including) 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 have improper access control during approval rule synchronization. An authenticated user can bypass a required merge request approval policy on a protected branch under certain conditions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-managed GitLab EE instances on 17.4 through 19.5.x before the fixed releases, especially those using required merge request approval policies on protected branches. Instances on Community Edition or on a fixed version can skip it. The sources do not describe the exact trigger conditions.
No product ranges from the sources yet.
gitlab-rake gitlab:env:info or the Version line in the Admin area; compare against the fixed releases below.19.3.6, 19.4.3, 19.5.1, or a later release on the same branch, per the GitLab patch notes.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a required merge request approval policy on a protected branch due to improper access control during approval rule synchronization.
This page as .md · .json · in your agent: get_signal("CVE-2026-14288")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.