GitLabCVE-2026-14288

GitLab: improper access control

CVE-2026-14288 · Published Oct 22, 2026 · updated Oct 30, 2026

Low3.1

Fix: upgrade to 19.3.6 or later (3 fixed versions below)

GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a required merge request approval policy on a protected branch due to improper access control during approval rule synchronization.

Affected versions

Package	Affected	Fixed in
GitLab Product	>= 17.4, < 19.3.6	19.3.6
	>= 19.4, < 19.4.3	19.4.3
	>= 19.5, < 19.5.1	19.5.1

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-706

More GitLab advisories

All GitLab

Medium 6.8Oct 22

GitLab: improper authorizationCVE-2026-12664fixed in 19.3.6 +2 Medium 4.3Oct 22

GitLab: missing authorizationCVE-2026-13319fixed in 19.3.6 +2 High 8.2Oct 22

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1...CVE-2026-15723fixed in 19.3.6 +2 Medium 5.9Oct 22

GitLab: improper authorizationCVE-2026-16255fixed in 19.3.6 +2 Medium 4.3Oct 22

GitLab: authenticated user could access paid AI features withoutCVE-2026-112378fixed in 19.3.6 +2 Low 2.7Oct 22

GitLab: improper authorizationCVE-2026-103515fixed in 19.3.6 +2