CVE-2026-13113

MediumCVSS 5.3/10Last modified Aug 3, 2026

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to merge code into a protected branch without the required approvals due to a race condition in approval rule processing.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-367

Affected software

No affected versions have been published.

Timeline

Published: Jul 29, 2026
Last modified: Aug 3, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-131147.2The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Conte CVE-2026-131164.3The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up t CVE-2026-131178.1An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-fr CVE-2026-131196.5The Registrations For The Events Calendar plugin for WordPress is vulnerable to SQL Injection via JSON keys in the 'standard' parameter hand CVE-2026-13125.4An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `.QuerySet.order_by()` is subject to SQL injection in CVE-2026-131217.8Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows loca CVE-2026-131225.3OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authe CVE-2026-131258.8GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with var CVE-2026-131267.8The embedded JavaScript in the PDF deleted the pages, making the object invalid. The application attempted to perform a write operation on t CVE-2026-131277.8The application opens the PDF file. JavaScript then rewrites the document to modify the page structure, resulting in the invalidation of the CVE-2026-131287.8Embedding JavaScript within a PDF file will cause the page to be deleted. Subsequent scripts will continue to access the relevant properties CVE-2026-131297.8When the application opens a PDF file, JavaScript uses the damaged field tree to trigger field traversal, resulting in the program holding a