CVE-2026-92528: GitLab Auth Bypass Vulnerability

CVE-2026-92528 Overview

CVE-2026-92528 is an authorization flaw in GitLab Enterprise Edition (EE) that allows an authenticated user to approve a merge request they contributed commits to. The weakness stems from improper identity resolution during approval checks, breaking the separation-of-duties control that normally blocks self-approval. The issue affects GitLab EE versions from 16.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. GitLab has released patched versions that restore correct identity matching during approval enforcement. The vulnerability is classified under [CWE-863: Incorrect Authorization].

Critical Impact
An authenticated contributor can approve their own merge request under specific conditions, undermining code review integrity and separation-of-duties controls in protected branches.

Affected Products

GitLab EE versions 16.11 up to (excluding) 19.2.8
GitLab EE versions 19.3 up to (excluding) 19.3.5
GitLab EE versions 19.4 up to (excluding) 19.4.2

Discovery Timeline

2026-10-13 - CVE-2026-92528 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-92528

Vulnerability Analysis

The vulnerability resides in GitLab EE's merge request approval workflow. GitLab normally prevents a user who authored or co-authored commits in a merge request from approving that same merge request. This enforces a code review separation-of-duties control required by many compliance frameworks.

In affected versions, the approval component fails to correctly resolve the identity of the user requesting approval against the identities associated with the commits in the merge request. Under specific conditions, the mismatch lets a contributing user pass the approval check and record an approval on their own change.

Successful exploitation requires an authenticated account with permission to approve merge requests in the target project. The attacker must also have contributed at least one commit to the merge request they wish to self-approve.

Root Cause

The root cause is improper identity resolution during authorization. GitLab associates commits with user identities through fields such as the author email, committer email, and linked user accounts. When these inputs do not deterministically map to a single canonical user, the approval policy evaluator can treat the approving user as a non-contributor. [CWE-863] applies because the authorization decision is made against incorrectly resolved subject attributes.

Attack Vector

Exploitation occurs over the network against a GitLab EE instance. The attacker authenticates as a project member with approval rights, opens or contributes to a merge request, and submits an approval through the web UI or REST API endpoint POST /projects/:id/merge_requests/:merge_request_iid/approve. No user interaction from a victim is required. No verified public proof-of-concept is available at this time. See the GitLab Patch Release 19.4.2 and GitLab Work Item #606772 for technical details.

Detection Methods for CVE-2026-92528

Indicators of Compromise

Approval events on merge requests where the approving user also appears in the commit author or committer list.
API calls to the merge request approve endpoint originating from accounts matching commit contributors on the same merge request.
Merge requests merged with fewer distinct approver identities than required by the project's approval rules.

Detection Strategies

Audit the GitLab audit_events and approvals tables for approvals where user_id matches a commit author_id or committer_id on the same merge request.
Correlate GitLab webhook merge_request approval events against commit metadata to flag self-approvals in near real time.
Review protected branch merge history for the affected version window and identify merges that bypassed the configured minimum approver count.

Monitoring Recommendations

Forward GitLab audit logs, API access logs, and webhook events to a centralized log platform for retention and correlation.
Alert on anomalous approval patterns, including rapid approve-then-merge sequences by a single contributor identity.
Track merge request approval API usage per user and baseline typical reviewer behavior to surface outliers.

How to Mitigate CVE-2026-92528

Immediate Actions Required

Upgrade GitLab EE to version 19.4.2, 19.3.5, or 19.2.8 depending on the deployed release branch.
Review merge requests merged during the affected version window and re-validate approvals for compliance-sensitive repositories.
Rotate or review permissions for accounts that performed suspicious self-approvals until the patch is applied.

Patch Information

GitLab has released fixed versions 19.2.8, 19.3.5, and 19.4.2 that correct identity resolution in the merge request approval path. Administrators should apply the appropriate patch following the guidance in the GitLab Patch Release 19.4.2 advisory. Self-managed GitLab EE instances should prioritize upgrading production and compliance-regulated environments first.

Workarounds

Enforce protected branch rules requiring approvals from members of a specific CODEOWNERS group that excludes contributors.
Increase the minimum required approvers on sensitive projects so a single bypassed approval cannot satisfy the policy.
Disable merge request approval permissions for lower-trust roles until the upgrade is completed.

bash

# Verify running GitLab version and plan upgrade
sudo gitlab-rake gitlab:env:info | grep -i version

# Example upgrade commands (Omnibus package)
# Debian/Ubuntu
sudo apt-get update && sudo apt-get install gitlab-ee=19.4.2-ee.0

# RHEL/CentOS
sudo yum install gitlab-ee-19.4.2-ee.0

# Verify approval rule enforcement after upgrade
sudo gitlab-rails runner "puts MergeRequest.count"