GitLab EE Approval Rule Authorization Bypass Vulnerability

A vulnerability exists in GitLab EE versions 16.10 prior to 18.9.7, 18.10 prior to 18.10.6, and 18.11 prior to 18.11.3. When instance-level approval rule editing prevention was enabled, this vulnerability could have allowed an authenticated user with Maintainer permissions to modify or delete project approval rules. The issue arises from a lack of proper authorization checks.

Impact

Exploitation of this vulnerability could lead to unauthorized modification or deletion of project approval rules by users with Maintainer permissions.