CVE-2026-7487
Last modified
CVE-2026-7487 is a low-severity vulnerability rated 3.5/10 on the CVSS scale. GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with reporter-role permissions who authored a merge request could have reset merge request approval rules due to improper authorization checks.. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with reporter-role permissions who authored a merge request could have reset merge request approval rules due to improper authorization checks.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gitlab | Gitlab | >= 13.1.0, < 19.1.7 |
| Gitlab | Gitlab | >= 19.2.0, < 19.2.5 |
| Gitlab | Gitlab | 19.3.0 |
References
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-1-released/Release Notes, Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/work_items/598657Issue Tracking, Permissions Required
- https://hackerone.com/reports/3669140Permissions Required, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-7487?
How severe is CVE-2026-7487?
How do I fix CVE-2026-7487?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-7486Improper neutralization of special elements used in an SQL c…9.8
- CVE-2026-74860A flaw was found in libxml2 with Python bindings enabled. A …8.5
- CVE-2026-74866@fastify/busboy is a multipart form-data parser for Node.js.…5.8
- CVE-2026-74867SiYuan versions before 3.7.4 contain a cross-site request fo…4.2
- CVE-2026-74868SiYuan versions before 3.7.4 contain an unthrottled brute-fo…7.5
- CVE-2026-74869stoatchat before 0.15.0 contains a missing authorization vul…7.7
- CVE-2026-74870openssl_encrypt (pip) versions <= 1.4.7 contain an informati…3.3
- CVE-2026-74871openssl_encrypt versions before 1.4.6 contain a key derivati…5.5
- CVE-2026-74872openssl_encrypt versions before 1.4.0 contain an arbitrary c…9.8
- CVE-2026-74873openssl_encrypt versions before 1.4.0 expose passwords passe…5.5
- CVE-2026-74874openssl_encrypt versions before 1.4.0 use Python's non-crypt…7.5
- CVE-2026-74875openssl_encrypt versions before 1.4.0 silently skip JSON sch…9.8
Are you affected by CVE-2026-7487?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST