CVE-2026-14288: gitlab gitlab

CVSS 3.1 (low) · published 2026-10-22

GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a required merge request approval policy on a protected branch due to improper access control during approval rule synchronization.

Affected products (NVD): gitlab gitlab

Fixed in (NVD): 19.3.6, 19.4.3

Weakness: CWE-706

Source: NVD CVE-2026-14288

References

• https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
• https://gitlab.com/gitlab-org/gitlab/-/work_items/604630
• https://hackerone.com/reports/3797008

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.