CVE-2026-6883: GitLab EE Auth Bypass Vulnerability

CVE-2026-6883 Overview

CVE-2026-6883 is an authorization bypass vulnerability in GitLab Enterprise Edition (EE). The issue allows an authenticated user to bypass merge request approval requirements. The root cause is improper cleanup of orphaned policy records, which leaves stale approval rules in an exploitable state. The flaw affects GitLab EE versions from 15.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3. GitLab has remediated the issue in subsequent patch releases. The weakness is categorized under [CWE-862] Missing Authorization.

Critical Impact

An authenticated user can merge code changes without satisfying configured approval policies, undermining code review controls and software supply chain integrity.

Affected Products

• GitLab EE versions 15.7 through 18.9.6
• GitLab EE versions 18.10 through 18.10.5
• GitLab EE versions 18.11 through 18.11.2

Discovery Timeline

• 2026-05-13 - GitLab releases patched versions 18.9.7, 18.10.6, and 18.11.3
• 2026-05-14 - CVE-2026-6883 published to NVD
• 2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-6883

Vulnerability Analysis

The vulnerability resides in GitLab EE's merge request approval policy enforcement logic. GitLab uses policy records to associate approval rules with projects and merge requests. When projects, policies, or related entities are deleted, the associated policy records should be cleaned up consistently. The flaw is the failure to remove orphaned policy records after their parent objects are removed or modified.

These stale records can produce inconsistent state during approval evaluation. An authenticated user with permission to open merge requests can leverage this inconsistency to merge changes without meeting the intended approver count or scope. The vulnerability requires high attack complexity, low privileges, and user interaction, which limits opportunistic exploitation. The integrity impact is limited to code or configuration changes that should have required additional reviewer approval.

Root Cause

The defect is a missing authorization check during merge request approval evaluation, classified as [CWE-862]. Orphaned policy records remain in the database after their parent entities are deleted. The approval engine references these stale records and reaches an incorrect authorization decision. Proper cascading cleanup of policy records would have prevented the inconsistent state.

Attack Vector

Exploitation is network-based and requires an authenticated account with permission to interact with merge requests in the target project. The attacker must trigger a project or policy state that yields orphaned records, then submit a merge request whose approval evaluation references the stale state. User interaction by another party in the workflow is required, which raises exploitation difficulty. No public proof-of-concept exploit is available. See the GitLab Patch Release Announcement and GitLab Work Item Overview for vendor details.

Detection Methods for CVE-2026-6883

Indicators of Compromise

• Merge requests merged into protected branches with fewer approvals than the configured policy requires.
• Audit log entries showing merges by users who are not listed in any active approval policy.
• Database records in approval policy tables that reference deleted projects, groups, or rules.

Detection Strategies

• Compare merged commits against required approver lists from the security policy project and flag mismatches.
• Query GitLab audit events for merge_request actions and correlate with approval rule satisfaction state.
• Run reconciliation jobs against approval policy tables to identify orphaned records referencing non-existent parent objects.

Monitoring Recommendations

• Forward GitLab audit logs and Rails production logs to a centralized analytics platform for retrospective analysis.
• Alert on merges to protected branches that occur outside expected reviewer workflows.
• Track GitLab version inventory across self-managed instances to confirm patch coverage.

How to Mitigate CVE-2026-6883

Immediate Actions Required

• Upgrade GitLab EE to 18.9.7, 18.10.6, or 18.11.3 or later as appropriate for your release branch.
• Audit recent merges to protected branches since GitLab 15.7 for approvals that bypassed configured policies.
• Review and reapply merge request approval policies after upgrading to ensure orphaned records are removed.

Patch Information

GitLab released the fix on May 13, 2026 in patch versions 18.9.7, 18.10.6, and 18.11.3. The patches correct the cleanup logic for orphaned policy records and restore correct approval enforcement. Refer to the GitLab Patch Release Announcement for the complete release notes and upgrade instructions.

Workarounds

• Restrict merge permissions on protected branches to a minimal trusted group until patches are applied.
• Require pipeline-based status checks in addition to approval policies to add a secondary control.
• Manually verify approval policy coverage for high-value projects and remove unused or stale policies.

# Verify installed GitLab version and confirm it is on a patched release
sudo gitlab-rake gitlab:env:info | grep -i "GitLab information" -A 5

# Self-managed administrators can review approval policy state via Rails console
sudo gitlab-rails runner "puts Security::OrchestrationPolicyConfiguration.count"