CVE-2026-6269: GitLab Authorization Bypass on Hidden Merge Requests

Technical summary

CVE-2026-6269 is an authorization enforcement bypass in GitLab CE/EE caused by inadequate access control checks on merge request operations. The vulnerability is categorized under CWE-863 (Incorrect Authorization). An authenticated user holding developer role permissions can, under specific conditions, gain write access to hidden or restricted merge requests. The CVSS 3.1 score of 5.4 (MEDIUM) reflects the requirement for valid credentials and developer privileges, balanced against the confidentiality and integrity impact on merge request data. The attack vector is network-based with low complexity, requiring no user interaction.

Business impact

The primary risk is unauthorized modification of merge request content by developers who should lack access. In organizations using GitLab's access controls to segregate code review responsibilities—such as restricting certain merge requests to senior engineers or security teams—this bypass undermines that segregation. An attacker with developer access could alter review comments, approval status indicators, or proposed code changes on protected merge requests, potentially introducing unreviewed changes into the codebase or obscuring audit trails. The impact is contained to merge request data rather than affecting the broader CI/CD pipeline or artifact storage.

Affected systems

All GitLab Community Edition and Enterprise Edition installations are affected across a wide version range: versions 15.10 through 18.10.7, all 18.11.x versions before 18.11.5, and 19.0.x before 19.0.2. Organizations running GitLab should verify their deployed version against these ranges to determine exposure.

Exploitability

Exploitability is limited by two essential preconditions: the attacker must possess valid GitLab credentials and hold at least developer-level permissions in the target project or group. The vulnerability does not grant code execution, infrastructure access, or privilege escalation. An attacker could only modify merge requests deemed 'hidden' or restricted under certain access control configurations. The low complexity of the attack vector suggests the vulnerability is straightforward to trigger once those prerequisites are met, but widespread exploitation is constrained by the authentication and role requirements.

Remediation

GitLab has released patched versions that restore proper authorization enforcement: upgrade to 18.10.8 or later, 18.11.5 or later, or 19.0.2 or later, depending on your current major version. Customers on versions prior to 15.10 are not affected. Verify your current GitLab version and test patches in a staging environment before production deployment to confirm the fix does not interfere with your merge request workflows.

Patch guidance

Identify your current GitLab version via the Admin Dashboard (Admin > System Information). Compare against the affected ranges: if you are on 18.10.x and below 18.10.8, 18.11.x and below 18.11.4, or 19.0.x and below 19.0.1, you require a patch. Plan an upgrade to the nearest fixed minor version within your release line. GitLab recommends testing in a non-production environment first. Since this fix corrects authorization logic, verify that your existing merge request visibility and approval rules continue to function as expected after patching. Coordinate the upgrade with your development team to minimize disruption during code review workflows.

Detection guidance

Review GitLab audit logs for developer-initiated modifications to merge requests marked as hidden, confidential, or with restricted visibility. Focus on merge requests that should have been immutable or requiring higher-level approvals. Monitor for unexpected changes to merge request metadata, descriptions, or approval states, particularly those changed by users whose role should not permit such actions. Determine the scope of modification by reviewing the audit trail for affected merge requests within the window between vulnerability disclosure (June 2026) and your patch deployment. Consider temporary restrictions on developer write access to hidden merge requests as a compensating control pending patch deployment.

Why prioritize this

Although the CVSS score of 5.4 indicates MEDIUM severity, prioritize patching based on your use of GitLab's access controls to protect sensitive code reviews. If your organization relies on restricted merge requests to gate approval by specific teams (e.g., security or architecture review), this vulnerability directly undermines that control and warrants higher priority. The fix is straightforward, with clear version targets, making remediation feasible within a standard patching cycle. Organizations with flat access models or no confidential merge requests face lower risk but should still patch to eliminate the vector entirely.

Risk score, explained

The CVSS 3.1 score of 5.4 reflects: (1) Network-accessible attack vector (AV:N), (2) Low attack complexity requiring only credential possession (AC:L), (3) Low privilege requirement (developer role, not admin) (PR:L), (4) No user interaction needed (UI:N), (5) Limited scope to the user's own session (S:U), and (6) Low confidentiality and integrity impact confined to merge request metadata and content (C:L/I:L), with no availability impact (A:N). The score balances the ease of exploitation against the constrained damage scope; this is neither a critical privilege escalation nor a trivial information leak.

Frequently asked questions