CVE-2026-2900 GitLab CVE debrief

Who should care

Defenders and administrators of GitLab EE instances, particularly those with Maintainer role users, should assess exposure and prioritize patching for versions 16.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3.

Why it matters

Defenders should prioritize verifying and applying patches for GitLab EE versions 16.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3, and assess exposure for Maintainer role users due to the remediation of an issue with missing authorization checks in project approval rules.

• Potential modification or deletion of project approval rules by authenticated users with Maintainer permissions
• Verification of patch application for affected GitLab EE versions
• Assessment of exposure for Maintainer role users
• Review of project approval rules for potential unauthorized changes

Technical summary

The issue in GitLab EE could have allowed an authenticated user with Maintainer permissions to modify or delete project approval rules due to missing authorization checks. GitLab has remediated this issue in versions 18.9.7, 18.10.6, and 18.11.3. Defenders should prioritize verifying and applying patches for GitLab EE versions 16.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3, and assess exposure for Maintainer role users. The remediation prevents potential modification or deletion of project approval rules by authenticated users with Maintainer permissions.

Defensive priority

Defenders should prioritize verifying and applying patches for GitLab EE versions 16.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3, and assess exposure for Maintainer role users.

Recommended defensive actions

• Verify and apply patches for GitLab EE versions 16.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3
• Assess exposure for Maintainer role users
• Review project approval rules for potential modifications or deletions
• Monitor for unauthorized changes to project approval rules
• Inventory affected GitLab EE instances for patching
• Track patch application exceptions and retest remediated assets
• Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The CVE record and GitHub advisory provide details on the remediation of an issue in GitLab EE. The issue could have allowed an authenticated user with Maintainer permissions to modify or delete project approval rules due to missing authorization checks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.