---
id: "CVE-2026-14288"
kind: "vulnerability"
aliases: ["CVE-2026-14288"]
title: "GitLab EE: authenticated users can bypass merge request approval policy"
severity: "low"
cvss: 3.1
epss: 0.00241
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["devops", "gitlab", "self-hosted", "vendor"]
not_affected_if: ["community-edition", "patched-version"]
published_at: "2026-10-22T01:16:59+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:47:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14288", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-14288", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# GitLab EE: authenticated users can bypass merge request approval policy

GitLab EE versions from 17.4 up to (not including) 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 have improper access control during approval rule synchronization. An authenticated user can bypass a required merge request approval policy on a protected branch under certain conditions.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the GitLab version with `gitlab-rake gitlab:env:info` or the Version line in the Admin area; compare against the fixed releases below.
- unknown whether approval policies on protected branches are configured in the affected instance; sources do not say which conditions trigger it.

## Fix

- Upgrade self-managed GitLab EE to `19.3.6`, `19.4.3`, `19.5.1`, or a later release on the same branch, per the GitLab patch notes.
- unknown whether GitLab.com (SaaS) was patched or needs action; sources do not say.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-14288
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-14288

## From the sources

GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a required merge request approval policy on a protected branch due to improper access control during approval rule synchronization.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_