GitLab EE Auth Bypass MR Approval Policy 17.4-19.5
CVE-2026-14288 Published on October 21, 2026
Use of Incorrectly-Resolved Name or Reference in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a required merge request approval policy on a protected branch due to improper access control during approval rule synchronization.
Vulnerability Analysis
CVE-2026-14288 is exploitable with network access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and no impact on availability.
Weakness Type
Use of Incorrectly-Resolved Name or Reference
The software uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
Products Associated with CVE-2026-14288
Want to know whenever a new CVE is published for GitLab? stack.watch will email you.
Affected Versions
GitLab:- Version 17.4 and below 19.3.6 is affected.
- Version 19.4 and below 19.4.3 is affected.
- Version 19.5 and below 19.5.1 is affected.