CVE-2026-2900

LowCVSS 2.7/10Last modified Nov 11, 2026

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 16.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that when instance-level approval rule editing prevention was enabled, could have allowed an authenticated user with Maintainer permissions to modify or delete project approval rules due to missing authorization checks.

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 16.10, < 18.9.7; >= 18.10, < 18.10.6; >= 18.11, < 18.11.3

References

https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/Release Notes
https://gitlab.com/gitlab-org/gitlab/-/work_items/590983Not Applicable
https://hackerone.com/reports/3561092Permissions Required

Timeline

Published: May 14, 2026
Last modified: Nov 11, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-290009.1pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encry CVE-2026-290017.2TastyIgniter through 4.4.5 contains a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code CVE-2026-290027.2CouchCMS contains a privilege escalation vulnerability that allows authenticated Admin-level users to create SuperAdmin accounts by tamperin CVE-2026-290048.1BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler in net CVE-2026-290075.3U-Boot through 2026.04-rc3 contains an out-of-bounds read vulnerability in tcp_rx_state_machine() (net/tcp.c) when CONFIG_PROT_TCP is enable CVE-2026-290087.5U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c) that allows a netw CVE-2026-290099.8U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled CVE-2026-290139.8libcoap contains out-of-bounds read vulnerabilities in OSCORE Appendix B.2 CBOR unwrap handling where get_byte_inc() in src/oscore/oscore_cb CVE-2026-290149.8MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute a CVE-2026-29026.1The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frontend_rewrite' CVE-2026-290227.8dr_libs dr_wav.h version 0.14.4 and earlier (fixed in commit 8a7258c) contain a heap buffer overflow vulnerability in the drwav__read_smpl_t CVE-2026-290237.3Keygraph Shannon contains a hard-coded API key in its router configuration that, when the router component is enabled and exposed, allows ne