{"attribution":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","cve":{"id":"CVE-2026-14288","sourceIdentifier":"cve@gitlab.com","published":"2026-10-22T01:16:59.340","lastModified":"2026-11-04T23:10:00.223","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a required merge request approval policy on a protected branch due to improper access control during approval rule synchronization."},{"lang":"es","value":"GitLab ha solucionado un problema en GitLab EE que afecta a todas las versiones desde la 17.4 hasta versiones anteriores a la 19.3.6, la 19.4 hasta versiones anteriores a la 19.4.3, y la 19.5 hasta versiones anteriores a la 19.5.1, que bajo ciertas condiciones podría haber permitido a un usuario autenticado eludir una política de aprobación de solicitudes de fusión (merge request) requerida en una rama protegida debido a un control de acceso inadecuado durante la sincronización de reglas de aprobación."}],"affected":[{"source":"cve@gitlab.com","affectedData":[{"vendor":"GitLab","product":"GitLab","defaultStatus":"unaffected","cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"repo":"https://gitlab.com/gitlab-org/gitlab","versions":[{"version":"17.4","lessThan":"19.3.6","versionType":"semver","status":"affected"},{"version":"19.4","lessThan":"19.4.3","versionType":"semver","status":"affected"},{"version":"19.5","lessThan":"19.5.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@gitlab.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T16:41:33.234512Z","id":"CVE-2026-14288","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@gitlab.com","type":"Secondary","description":[{"lang":"en","value":"CWE-706"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"17.4.0","versionEndExcluding":"19.3.6","matchCriteriaId":"A55DA112-4F57-46F5-9FE5-229B0C88B199"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"19.4.0","versionEndExcluding":"19.4.3","matchCriteriaId":"30C796E1-40AA-41AF-8186-A49F78DC528D"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:19.5.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"7D6BE6DD-CA49-4E20-9541-22477632BA5D"}]}]}],"references":[{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/","source":"cve@gitlab.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/604630","source":"cve@gitlab.com","tags":["Permissions Required"]},{"url":"https://hackerone.com/reports/3797008","source":"cve@gitlab.com","tags":["Permissions Required"]}]}}