CVE-2026-7487 - Access Control Check Implemented After Asset is Accessed in GitLab

Back Back to CVE browser

LOW

Access Control Check Implemented After Asset is Accessed in GitLab

Published Aug 26, 2026

3.5

LOW

CVSS 3.1

EPSS 0.32%

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with reporter-role permissions who authored a merge request could have reset merge request approval rules due to improper authorization checks.

Affected products

Vendor GitLab Product GitLab Default
unaffected
- Version
  13.1
  Status
  affected
  Constraints
  <19.1.7
- Version
  19.2
  Status
  affected
  Constraints
  <19.2.5
- Version
  19.3
  Status
  affected
  Constraints
  <19.3.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

GitLab

unaffected

Version	Status	Constraints
13.1	affected	<19.1.7
19.2	affected	<19.2.5
19.3	affected	<19.3.1

Remediation

Vendor solution

Upgrade to versions 19.1.7, 19.2.5, 19.3.1 or above.

Weaknesses (1)

CWE-1280

References (3)

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-1-released/
Release NotesVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/work_items/598657
Issue TrackingPermissions Required
https://hackerone.com/reports/3669140
technical-descriptionexploitpermissions-requiredPermissions RequiredThird Party Advisory

Link	Providers	Tags
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-1-released/		Release NotesVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/work_items/598657		Issue TrackingPermissions Required
https://hackerone.com/reports/3669140		technical-descriptionexploitpermissions-requiredPermissions RequiredThird Party Advisory