CVE-2026-14288

LowCVSS 3.1/10Last modified Oct 22, 2026

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a required merge request approval policy on a protected branch due to improper access control during approval rule synchronization.

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-706

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 22, 2026
Last modified
Oct 22, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-142899.0The FacturaONE para WooCommerce con VeriFactu WordPress plugin before 5.37 does not authenticate one of its request handlers, whose only proCVE-2026-14295.4Single Sign-On Portal System developed by WellChoose has a Reflected Cross-site Scripting vulnerability, allowing authenticated remote attacCVE-2026-142906.8The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTMLCVE-2026-142917.5The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authenticCVE-2026-142925.4The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end packageCVE-2026-142938.8The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public requesCVE-2026-142967.5When using the Direct XIP update strategy, the main application image starts other cores (i.e. radio core), based on the currently active slCVE-2026-142978.7A buffer overflow in the Bluetooth Continuous Glucose Monitoring Service (CGMS) Record Access Control Point (RACP) write handler aCVE-2026-142986.5Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit decompressed content size and enCVE-2026-14304.8The WP Lightbox 2 WordPress plugin before 3.0.7 does not sanitise and escape some of its settings, which could allow high privilege users suCVE-2026-143008.1The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind the one-time code CVE-2026-143045.5In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based applicat