CVE-2026-7487: 
GitLab 취약성 분석 및 완화

CVE-2026-7487 is an improper authorization vulnerability in GitLab Enterprise Edition (EE) that allows an authenticated user with reporter-role permissions who authored a merge request to reset merge request approval rules under certain conditions. It affects all GitLab EE versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1. The vulnerability was disclosed on August 26, 2026, and has a CVSS v3.1 base score of 3.5 (Low) (GitHub Advisory, GitLab Patch Release).

The root cause is classified as CWE-1280 (Access Control Check Implemented After Asset is Accessed), meaning the authorization check for modifying merge request approval rules is performed after the asset has already been accessed or modified. An authenticated network-accessible attacker with at least reporter-level permissions who has authored a merge request can exploit this flaw to reset approval rules, bypassing configured review requirements. Exploitation requires low privileges and some user interaction, and is not automatable according to NVD SSVC assessment. The vulnerability was originally reported via HackerOne (report #3669140) (GitHub Advisory, GitLab Patch Release).

Successful exploitation allows an authenticated reporter-role user to reset merge request approval rules, effectively bypassing configured code review and approval requirements. This has a low integrity impact — unauthorized changes could be merged without the required number or type of approvals — but there is no confidentiality or availability impact. The primary risk is to software supply chain integrity within affected GitLab EE projects, as malicious or unreviewed code could be introduced into protected branches (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The NVD SSVC assessment confirms exploitation is currently "none" and the vulnerability is not automatable. The EPSS score is approximately 0.23%, placing it in the 13th percentile for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Reconnaissance: Identify a GitLab EE instance running a vulnerable version (13.1 through 19.1.6, 19.2.0 through 19.2.4, or 19.3.0) with merge request approval rules configured on one or more projects.
2. Obtain reporter-level access: Authenticate to the GitLab instance with an account that has at least reporter-role permissions on the target project.
3. Author a merge request: Create or identify an existing merge request authored by the attacker's account on the target project.
4. Trigger the authorization bypass: Under the specific conditions described in the vulnerability, interact with the merge request in a way that triggers the improper authorization check, allowing the approval rules to be reset.
5. Reset approval rules: Exploit the flaw to clear or modify the merge request approval rules, removing required approvals and enabling the merge request to be merged without the intended review process (GitHub Advisory).

• Logs: GitLab audit logs showing unexpected modifications to merge request approval rules by users with reporter-level permissions; audit events for approval rule resets not initiated by project maintainers or owners.
• Application Activity: Merge requests merged with fewer approvals than the configured minimum, particularly those authored by reporter-role users.
• GitLab Audit Events: Audit trail entries showing approval_rules changes on merge requests authored by low-privilege accounts (GitHub Advisory).

GitLab has released patched versions: 19.1.7, 19.2.5, and 19.3.1. All GitLab EE administrators should upgrade to one of these versions immediately. As a temporary workaround, organizations can restrict reporter-role permissions on merge requests where not required for workflow, and audit existing merge request approval rule configurations for unauthorized modifications (GitLab Patch Release, GitHub Advisory).