CVE-2026-14288
Last modified
CVE-2026-14288 is a low-severity vulnerability rated 3.1/10 on the CVSS scale. GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a required merge request approval policy on a protected branch due to improper access control during approval rule synchronization.. EPSS estimates a 0.26% chance of exploitation in the next 30 days.
Description
GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a required merge request approval policy on a protected branch due to improper access control during approval rule synchronization.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gitlab | Gitlab | >= 17.4.0, < 19.3.6 |
| Gitlab | Gitlab | >= 19.4.0, < 19.4.3 |
| Gitlab | Gitlab | 19.5.0 |
References
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/Release Notes, Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/work_items/604630Permissions Required
- https://hackerone.com/reports/3797008Permissions Required
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-14288?
How severe is CVE-2026-14288?
How do I fix CVE-2026-14288?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-1428Single Sign-On Portal System developed by WellChoose has a O…8.8
- CVE-2026-14280The Events Manager – Calendar, Bookings, Tickets, and more! …6.6
- CVE-2026-14281The Automation Web Platform – Notifications and OTP for WooC…9.8
- CVE-2026-14282The GoDAM – Organize WordPress Media Library & File Manager …9.8
- CVE-2026-14286Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2026-14287The 10Web Booster WordPress plugin before 2.33.5 does not c…4.7
- CVE-2026-14289The FacturaONE para WooCommerce con VeriFactu WordPress plug…9
- CVE-2026-1429Single Sign-On Portal System developed by WellChoose has a R…5.4
- CVE-2026-14290The Embed Google Photos album WordPress plugin through 2.2.1…6.8
- CVE-2026-14291The security-ninja-premium WordPress plugin before 5.290 doe…7.5
- CVE-2026-14292The Download Manager WordPress plugin before 3.3.66 does not…5.4
- CVE-2026-14293The Autopay WordPress plugin before 5.0.1 does not perform a…8.8
Are you affected by CVE-2026-14288?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST