BIT-gitlab-2026-7487

vendorUSosv

Access Control Check Implemented After Asset is Accessed in GitLab

view advisory published 2026-09-01Licence: per source

GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with reporter-role permissions who authored a merge request could have reset merge request approval rules due to improper authorization checks.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-7487US	—	0.32% (24th)	—	2026-08-26
GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authentica…

references

External citations — patches, advisories, analysis.

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-1-released/ADVISORY
https://gitlab.com/gitlab-org/gitlab/-/work_items/598657REPORT
https://hackerone.com/reports/3669140ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2026-7487WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan