Vulnerability Description
GitLab has remediated an issue in GitLab EE affecting all versions from 16.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that when instance-level approval rule editing prevention was enabled, could have allowed an authenticated user with Maintainer permissions to modify or delete project approval rules due to missing authorization checks.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gitlab | Gitlab | >= 16.10.0, < 18.9.7 |
Related Weaknesses (CWE)
References
- https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-releasRelease Notes
- https://gitlab.com/gitlab-org/gitlab/-/work_items/590983Not Applicable
- https://hackerone.com/reports/3561092Permissions Required
FAQ
What is CVE-2026-2900?
CVE-2026-2900 is a vulnerability with a CVSS score of 2.7 (LOW). GitLab has remediated an issue in GitLab EE affecting all versions from 16.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that when instance-level approval rule editing prevention wa...
How severe is CVE-2026-2900?
CVE-2026-2900 has been rated LOW with a CVSS base score of 2.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-2900?
Check the references section above for vendor advisories and patch information. Affected products include: Gitlab Gitlab.