CVE-2026-2900

2.7 Faible

Publiée le 14/05/2026 à 08:16 · Modifiée le 17/06/2026 à 12:31 · Analysée par le NVD · Source : cve@gitlab.com

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 16.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that when instance-level approval rule editing prevention was enabled, could have allowed an authenticated user with Maintainer permissions to modify or delete project approval rules due to missing authorization checks.

Traduire en français

Produits concernés

GitLab
Gitlab gitlab

Scores CVSS

Version	Score	Source	Vecteur
3.1	2.7 Faible	cve@gitlab.com	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N`

Faiblesses (CWE)

CWE-862

Références

https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/ Release Notes
https://gitlab.com/gitlab-org/gitlab/-/work_items/590983 Not Applicable
https://hackerone.com/reports/3561092 Permissions Required

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories