CVE-2026-2900: GitLab EE Authorization Bypass Vulnerability

CVE-2026-2900 Overview

CVE-2026-2900 is a missing authorization vulnerability [CWE-862] in GitLab Enterprise Edition (EE). The flaw affects all versions from 16.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3. When instance-level approval rule editing prevention was enabled, an authenticated user with Maintainer permissions could modify or delete project approval rules. The issue stems from missing authorization checks on the affected endpoints. GitLab released patches in versions 18.9.7, 18.10.6, and 18.11.3.

Critical Impact
Authenticated Maintainers can bypass instance-level controls and tamper with project approval rules, weakening merge request governance and code review enforcement.

Affected Products

GitLab EE versions 16.10 through 18.9.6
GitLab EE versions 18.10 through 18.10.5
GitLab EE versions 18.11 through 18.11.2

Discovery Timeline

2026-05-13 - GitLab releases patch versions 18.9.7, 18.10.6, and 18.11.3
2026-05-14 - CVE-2026-2900 published to NVD
2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-2900

Vulnerability Analysis

The vulnerability is a broken access control issue in GitLab EE's project approval rule management. GitLab EE exposes an instance-level setting that prevents project Maintainers from editing approval rules. This setting is intended to let administrators enforce uniform merge request approval policies across all projects. The affected code paths that modify or delete project approval rules failed to validate this instance-level restriction.

As a result, a Maintainer could submit requests that bypass the administrator-defined policy. The authorization check that should reject such requests was absent, allowing approval rules to be altered or removed despite the global protection being enabled. Approval rules govern who must review and approve merge requests before code is integrated into protected branches.

The impact is limited to integrity of approval policy data. Confidentiality and availability are not affected, and exploitation requires high privileges (Maintainer role) on a target project.

Root Cause

The root cause is missing server-side authorization enforcement [CWE-862] on the project approval rule update and delete operations. The application relied on the user's project role without re-evaluating the instance-level prevent_approval_rule_editing policy at the API and service layer.

Attack Vector

An attacker first needs valid GitLab credentials with Maintainer permissions on a target project. The attacker then issues authenticated API requests against project approval rule endpoints to add, modify, or delete rules. Because the server does not consult the instance-level prevention flag, the request succeeds. The attacker can lower required approver counts, remove required reviewers, or delete rules entirely to facilitate the merging of unreviewed code.

No public proof-of-concept code is available. Technical details are documented in the GitLab Work Item #590983 and the HackerOne Report #3561092.

Detection Methods for CVE-2026-2900

Indicators of Compromise

Audit log entries showing approval_rule create, update, or delete events performed by Maintainer-role accounts on instances where instance-level approval rule editing prevention is enabled.
Merge requests merged with fewer approvers than the instance-level policy mandates.
Unexpected modifications to approval_project_rules records that do not correlate with administrator activity.

Detection Strategies

Review GitLab audit events for project_approval_rule actions and correlate the actor's role with the instance-level policy state.
Compare current project approval rule configurations against a known-good baseline derived from the instance policy.
Alert on API calls to /api/v4/projects/:id/approval_rules endpoints originating from non-administrator accounts when the instance prevention flag is set.

Monitoring Recommendations

Forward GitLab audit and application logs to a centralized SIEM and retain them for retrospective analysis.
Track the GitLab instance version against the fixed releases and alert when running unpatched builds.
Monitor merge request activity for policy deviations such as reduced required approver counts or removed eligible approver groups.

How to Mitigate CVE-2026-2900

Immediate Actions Required

Upgrade GitLab EE to version 18.11.3, 18.10.6, or 18.9.7 depending on your release branch.
Audit project approval rules across all projects and restore any unauthorized changes.
Review Maintainer role assignments and remove unnecessary grants to reduce the population of users able to exploit the flaw.

Patch Information

GitLab addressed the missing authorization check in the GitLab Patch Release Announcement for versions 18.11.3, 18.10.6, and 18.9.7. The patch enforces the instance-level prevent_approval_rule_editing policy at the service layer for all create, update, and delete operations on project approval rules. Self-managed customers should apply the upgrade following GitLab's standard release procedure; GitLab.com is already running the patched version.

Workarounds

If immediate patching is not possible, restrict the Maintainer role to a small set of trusted users on affected projects.
Enable and review the audit event stream for all approval rule changes to detect tampering quickly.
Use protected branches with administrator-managed approval requirements to add a second layer of control over merges.

bash

# Verify GitLab version and upgrade on a self-managed instance
sudo gitlab-rake gitlab:env:info | grep -i version
sudo apt-get update && sudo apt-get install gitlab-ee=18.11.3-ee.0
sudo gitlab-ctl reconfigure