CVE-2026-92528
4.2MediumPublished 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-863
Impact
Authenticated users can approve their own merge requests despite having contributed commits to them, bypassing separation-of-duties controls. Attackers need network access and an authenticated account with permission to approve merge requests.
Root cause
Improper identity resolution fails to correctly recognize a committer's identity during merge request approval checks.
Affected systems
GitLab EE 16.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Fix & remediation
Upgrade GitLab EE to version 19.2.8, 19.3.5, 19.4.2, or later. No interim mitigation is documented, so prioritize patching.
$ sudo apt-get update && sudo apt-get install --only-upgrade gitlab-eeAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
GitLab has remediated an issue in GitLab EE affecting all versions from 16.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to approve a merge request despite having contributed commits to it, due to improper identity resolution.
References
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/Release NotesVendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/work_items/606772Issue Tracking