CVE-2026-7487: 
GitLab vulnerability analysis and mitigation

CVE-2026-7487 is an improper authorization vulnerability in GitLab EE that allows an authenticated user with reporter-role permissions who authored a merge request to reset merge request approval rules under certain conditions. It affects all GitLab EE versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1. The vulnerability was disclosed on August 26, 2026, and has a CVSS v3.1 base score of 3.5 (Low) (GitHub Advisory, GitLab Patch Release).

The root cause is classified as CWE-1280 (Access Control Check Implemented After Asset is Accessed), meaning the authorization check for modifying merge request approval rules is performed after the asset has already been accessed or acted upon. An authenticated network-based attacker with low privileges (reporter role) who has authored a merge request can exploit this flaw to reset approval rules, bypassing the intended access control enforcement. Exploitation requires some user interaction and does not result in a scope change. The vulnerability was originally reported via HackerOne (report #3669140) (GitHub Advisory).

Successful exploitation allows an authenticated reporter-level user to reset merge request approval rules, effectively bypassing configured code review and approval requirements. This poses an integrity risk, as unauthorized or malicious code changes could be merged without the required approvals. There is no confidentiality or availability impact, and the scope is limited to the affected GitLab EE instance (GitHub Advisory).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.0, and exploitation is assessed as non-automatable due to the requirement for user interaction and specific role conditions (GitHub Advisory).

1. Identify a target: Locate a GitLab EE instance running a vulnerable version (13.1 through 19.1.6, 19.2.0–19.2.4, or 19.3.0) with merge request approval rules configured.
2. Authenticate as a reporter: Log in with an account that has at least reporter-level permissions on the target project.
3. Author a merge request: Create or identify a merge request that was authored by the attacker's account on the target project.
4. Trigger the authorization bypass: Under the specific conditions described in the vulnerability, interact with the merge request in a way that invokes the improperly ordered access control check, allowing the approval rules to be reset.
5. Reset approval rules: Exploit the improper authorization to clear or modify the merge request approval rules, removing required approvals and potentially enabling unauthorized code to be merged (GitHub Advisory).

• Logs: GitLab application logs showing unexpected modification or reset of merge request approval rules by users with reporter-level roles; audit log entries for approval rule changes not initiated by project maintainers or owners.
• Application Activity: Merge requests with approval rules unexpectedly cleared or reset, particularly those authored by reporter-role users; merges completed without the expected number of approvals.
• User Behavior: Reporter-role accounts interacting with merge request approval rule settings beyond their expected permissions (GitHub Advisory).

GitLab has released patched versions 19.1.7, 19.2.5, and 19.3.1 for GitLab EE. Organizations should upgrade to one of these versions as the primary remediation. As a workaround, administrators can restrict reporter-role permissions on merge requests where not required, and should audit merge request approval rule configurations for any unauthorized modifications (GitLab Patch Release, GitHub Advisory).