VDB

CVE-2026-6063

CVE-2026-6063 PUBLISHED CVSS 4.300000190734863 MEDIUM

GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that under certain conditions could have allowed an authenticated user with developer-role permissions to remove code owner approval rules from merge requests due to improper access control.

EPSS 0.01% · 1.5th percentile

Risk Scores

CVSS 3.1
4.300000190734863
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS Score
0.01%
1.5th percentile

Affected Products

VendorProductVersions
GitLabGitLab11.10, 18.10, 18.11

Timeline

  • May 14, 2026 CVE Published
  • May 14, 2026 PoC Published
  • May 15, 2026 Security Advisory
  • May 16, 2026 EPSS Score
  • May 18, 2026 EPSS Score
  • May 19, 2026 EPSS Score
  • May 20, 2026 EPSS Score
  • May 21, 2026 EPSS Score
  • May 22, 2026 EPSS Score
  • May 23, 2026 EPSS Score
  • May 24, 2026 EPSS Score
  • May 25, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›