CVE-2026-7487

GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with reporter-role permissions who authored a merge request could have reset merge request approval rules due to improper authorization checks.

Scoring

Severity

LOW

CVSS base score

3.5

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

EPSS probability

0.22%

CWE

CWE-1280

Published

2026-08-26

Last modified

2026-08-26

Affected products

• GitLab GitLab
• GitLab GitLab
• GitLab GitLab

Weakness type

• CWE-1280

Related vulnerabilities

• CVE-2026-3607 — Access Control Check Implemented After Asset is Accessed in GitLab

Markdown version · Browse all CVEs