{"id":"CVE-2026-14288","kind":"vulnerability","aliases":["CVE-2026-14288"],"related":[],"title":"GitLab EE: authenticated users can bypass merge request approval policy","description":"GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a required merge request approval policy on a protected branch due to improper access control during approval rule synchronization.","summary":"GitLab EE versions from 17.4 up to (not including) 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 have improper access control during approval rule synchronization. An authenticated user can bypass a required merge request approval policy on a protected branch under certain conditions.","severity":"low","cvss":3.1,"epss":0.00241,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["devops","gitlab","self-hosted","vendor"],"not_affected_if":["community-edition","patched-version"],"how_to_check":"- Check the GitLab version with `gitlab-rake gitlab:env:info` or the Version line in the Admin area; compare against the fixed releases below.\n- unknown whether approval policies on protected branches are configured in the affected instance; sources do not say which conditions trigger it.","fix":"- Upgrade self-managed GitLab EE to `19.3.6`, `19.4.3`, `19.5.1`, or a later release on the same branch, per the GitLab patch notes.\n- unknown whether GitLab.com (SaaS) was patched or needs action; sources do not say.","status":"open","published_at":"2026-10-22T01:16:59+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:47:27+00:00","updated_at":"2026-10-25T04:47:27+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:47:27Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade self-managed GitLab EE to `19.3.6`, `19.4.3`, `19.5.1`, or a later release on the same branch, per the GitLab patch notes.\n- unknown whether GitLab.com (SaaS) was patched or needs action; sources do not say.","reach":"network","title":"GitLab EE: authenticated users can bypass merge request approval policy","impact":"medium","summary":"GitLab EE versions from 17.4 up to (not including) 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 have improper access control during approval rule synchronization. An authenticated user can bypass a required merge request approval policy on a protected branch under certain conditions.","category":"vendor","nicknames":[],"who_cares":["gitlab","self-hosted","devops"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated user merges code past a required approval policy","analyst_note":"","how_to_check":"- Check the GitLab version with `gitlab-rake gitlab:env:info` or the Version line in the Admin area; compare against the fixed releases below.\n- unknown whether approval policies on protected branches are configured in the affected instance; sources do not say which conditions trigger it.","needs_analyst":false,"not_affected_if":["community-edition","patched-version"],"who_is_affected":"Self-managed GitLab EE instances on 17.4 through 19.5.x before the fixed releases, especially those using required merge request approval policies on protected branches. Instances on Community Edition or on a fixed version can skip it. The sources do not describe the exact trigger conditions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000638,"input_tokens":3389,"output_tokens":599,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-14288':13A,16A '-2026':12A,15A '17.4':27B,78C '19.3.6':32B,80C '19.4':33B,81C '19.4.3':35B,83C '19.5':37B,85C '19.5.1':39B,87C 'access':42B,112C 'affect':74C 'allow':94C 'approv':9A,45B,57B,103C,115C 'authent':3A,49B,96C 'branch':62B,108C 'bypass':6A,52B,98C 'certain':64B,90C 'condit':65B,91C 'control':43B,113C 'could':92C 'cve':11A,14A 'devop':17B 'due':109C 'ee':2A,24B,73C 'gitlab':1A,18B,23B,66C,72C 'host':21B 'improp':41B,111C 'includ':31B 'issu':70C 'merg':7A,55B,101C 'polici':10A,58B,104C 'protect':61B,107C 'remedi':68C 'request':8A,56B,102C 'requir':54B,100C 'rule':46B,116C 'self':20B 'self-host':19B 'synchron':47B,117C 'user':4A,50B 'vendor':22B 'version':25B,76C","nicknames":[],"mitigations":[],"who_affected":"Self-managed GitLab EE instances on 17.4 through 19.5.x before the fixed releases, especially those using required merge request approval policies on protected branches. Instances on Community Edition or on a fixed version can skip it. The sources do not describe the exact trigger conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T01:16:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-14288","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14288","severity":null,"published_at":"2026-10-22T01:16:59+00:00","modified_at":"2026-10-22T16:18:19+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-14288","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-14288","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}