CVE-2026-2726: GitLab Auth Bypass Vulnerability

CVE-2026-2726 Overview

A significant authorization bypass vulnerability has been identified in GitLab Community Edition (CE) and Enterprise Edition (EE) that could allow authenticated users to perform unauthorized actions on merge requests across different projects. This improper access control flaw affects cross-repository operations, potentially enabling attackers to manipulate merge requests in projects where they should not have modification privileges.

Critical Impact

Authenticated users could bypass access controls to perform unauthorized modifications to merge requests in repositories they do not have write access to, potentially compromising code integrity and collaboration workflows.

Affected Products

• GitLab Community Edition (CE) versions 11.10 to before 18.8.7
• GitLab Enterprise Edition (EE) versions 11.10 to before 18.8.7
• GitLab CE/EE versions 18.9 to before 18.9.3
• GitLab CE/EE version 18.10.0

Discovery Timeline

• 2026-03-25 - CVE-2026-2726 published to NVD
• 2026-03-25 - GitLab releases security patch (versions 18.8.7, 18.9.3, 18.10.1)
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-2726

Vulnerability Analysis

This vulnerability is classified as CWE-863 (Incorrect Authorization), which occurs when software does not correctly verify that the requesting user has the required permissions to access a resource or perform an action. In the context of GitLab, the flaw manifests during cross-repository operations involving merge requests.

The vulnerability affects a wide range of GitLab versions spanning approximately seven years of releases, from version 11.10 through to version 18.10.0. This extensive affected version range indicates that the authorization logic flaw has been present in the codebase for an extended period.

The impact allows authenticated users—who would normally have limited or no access to certain projects—to perform unauthorized actions on merge requests. This could include viewing, modifying, or interacting with merge requests in projects outside their authorized scope.

Root Cause

The root cause of CVE-2026-2726 is improper access control validation during cross-repository operations. When GitLab processes merge request actions that span multiple repositories, the authorization checks fail to properly verify that the authenticated user has the appropriate permissions for the target repository containing the merge request.

This authorization gap occurs because the access control logic does not adequately scope permission checks to the specific project context when handling cross-repository merge request operations.

Attack Vector

The attack vector is network-based and requires a low-privileged authenticated account. An attacker with valid credentials to any GitLab instance could potentially:

1. Identify target projects with accessible merge requests
2. Craft requests that exploit the cross-repository operation mechanism
3. Perform unauthorized actions on merge requests in projects where they lack proper authorization

Since no proof-of-concept exploit code has been publicly released, the specific exploitation technique involves manipulating cross-repository API calls or web interface actions. The vulnerability was responsibly reported through GitLab's HackerOne bug bounty program as documented in HackerOne Report #3543886.

Detection Methods for CVE-2026-2726

Indicators of Compromise

• Unusual merge request activity from users who do not have documented project membership
• API calls or web requests involving cross-repository merge request operations from unauthorized sources
• Audit logs showing merge request modifications by users without appropriate project access levels
• Unexpected changes to merge request status, labels, or assignments in protected projects

Detection Strategies

• Review GitLab audit logs for merge request events performed by users without project membership
• Monitor for unusual patterns in merge request API endpoint access, particularly those involving cross-project references
• Implement alerts for merge request modifications in high-value repositories by users with only external or minimal access
• Analyze web server logs for suspicious cross-repository operation request patterns

Monitoring Recommendations

• Enable and review GitLab's built-in audit event streaming for merge request activities
• Configure SIEM rules to correlate user permissions with merge request modification events
• Implement automated scanning for GitLab version compliance across all instances
• Establish baseline behavior patterns for cross-repository operations to detect anomalies

How to Mitigate CVE-2026-2726

Immediate Actions Required

• Upgrade GitLab CE/EE to version 18.8.7, 18.9.3, or 18.10.1 depending on your current major version branch
• Audit recent merge request activity across all projects for unauthorized modifications
• Review user access levels and ensure principle of least privilege is enforced
• Consider temporarily restricting cross-repository operations until patching is complete

Patch Information

GitLab has released security patches addressing this vulnerability in the following versions:

• 18.8.7 - For customers on the 18.8.x release branch
• 18.9.3 - For customers on the 18.9.x release branch
• 18.10.1 - For customers on the 18.10.x release branch

The official patch release announcement is available at GitLab Patch Release 18.10.1. Additional technical details can be found in the GitLab Work Item #590717.

Workarounds

• Implement network-level access controls to limit GitLab access to trusted networks until patching is complete
• Enable additional authentication requirements (MFA) for all users with write access to sensitive repositories
• Review and audit project membership across the GitLab instance to identify potentially over-permissioned accounts
• Consider temporarily disabling or restricting features that involve cross-repository operations if supported by your configuration