CVE-2026-14288

3.1 LOW

Published 2026-10-22 · Updated 2026-10-22

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a required merge request approval policy on a protected branch due to improper access control during approval rule synchronization.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Weaknesses

CWE-706

All references

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
https://gitlab.com/gitlab-org/gitlab/-/work_items/604630
https://hackerone.com/reports/3797008

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2026-106181
MEDIUMCVE-2026-106230
HIGHCVE-2026-106274
HIGHCVE-2026-106279
HIGHCVE-2026-106308
MEDIUMCVE-2026-106325
HIGHCVE-2026-106409
MEDIUMCVE-2026-107822PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.