CVE-2026-6883

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 15.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to bypass merge request approval requirements due to improper cleanup of orphaned policy records.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
May 14, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-688305.5Improper link resolution before file access ('link following') in Windows Universal Plug and Play (UPnP) Device Host allows an authorized atCVE-2026-688315.5Files or directories accessible to external parties in Windows Defender Firewall Service allows an authorized attacker to disclose informatiCVE-2026-688327.8Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges locally.CVE-2026-688336.8Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code with a physical attack.CVE-2026-688348.0Stack-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges over a network.CVE-2026-688357.1Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges over a network.CVE-2026-688367.8Heap-based buffer overflow in Windows kernel32.dll allows an authorized attacker to elevate privileges locally.CVE-2026-688377.0Use after free in Windows File History Service allows an authorized attacker to elevate privileges locally.CVE-2026-688388.0Stack-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges over a network.CVE-2026-688399.8Heap-based buffer overflow in Windows USB Mass Storage Class Driver allows an unauthorized attacker to execute code over a network.CVE-2026-688407.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Driver allows an authorized attacCVE-2026-688417.8Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.
CVE-2026-6883: Medium severity, CVSS 4.3 | Vulnix