PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-92528 GitLab CVE debrief

GitLab has remediated an issue in GitLab EE affecting all versions from 16.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to approve a merge request despite having contributed commits to it, due to improper identity resolution. The issue was identified and addressed through internal review and testing, ensuring that merge request approvals are properly validated. Administrators should verify their deployments and apply patches to prevent potential unauthorized merge request approvals.

Vendor
GitLab
Product
Unknown
CVSS
MEDIUM 4.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-13
Original CVE updated
2026-10-13
Advisory published
2026-10-13
Advisory updated
2026-10-13

Who should care

GitLab EE administrators and security teams should assess exposure and apply patches to prevent potential unauthorized merge request approvals. They should also review and update access controls for merge requests, monitor merge request approval logs for suspicious activity, and verify their deployments to ensure protection against this vulnerability.

Why it matters

CVE-2026-92528 allows authenticated users to approve merge requests they contributed to, potentially bypassing authorization checks. Defenders should verify exposure in GitLab EE deployments and apply vendor patches.

  • Verify and apply patches to prevent unauthorized merge request approvals
  • Review and update access controls for merge requests
  • Monitor merge request approval logs for suspicious activity

Technical summary

The vulnerability affects GitLab EE versions 16.11 to 19.4.2 and allows authenticated users to approve merge requests they have contributed to due to improper identity resolution. This issue arises from a flaw in the merge request approval process, which fails to correctly verify the contributor's identity before granting approval. Defenders should prioritize verifying exposure in GitLab EE deployments and applying vendor patches due to potential unauthorized merge request approvals. Additionally, reviewing and updating access controls for merge requests can help mitigate this vulnerability.

Defensive priority

Defenders should prioritize verifying exposure in GitLab EE deployments and applying vendor patches due to potential unauthorized merge request approvals.

Recommended defensive actions

  • Verify GitLab EE version and apply patches if necessary
  • Review merge request approval logs for unauthorized approvals
  • Implement additional access controls for merge requests
  • Monitor merge request approval logs for suspicious activity
  • Review and update access controls for merge requests
  • Verify exposure in GitLab EE deployments
  • Track exceptions and retest remediated assets

Evidence notes

The CVE Program and NVD provide official records of the vulnerability. GitLab has documented patches for affected versions. Additional sources, including security researchers and GitLab's own security team, have verified the issue and its remediation. Defenders should consult official advisories and apply patches to ensure protection against this vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-92528 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-92528

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-92528 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-92528

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Incorrect Authorization in GitLab

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/92xxx/CVE-2026-92528.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://gitlab.com/gitlab-org/gitlab/-/work_items/606772

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.