GitLab EE Merge Request Approval Bypass Vulnerability

A vulnerability exists in GitLab EE in all versions from 15.7 prior to 18.9.7, 18.10 prior to 18.10.6, and 18.11 prior to 18.11.3. This vulnerability could have allowed an authenticated user to bypass merge request approval requirements. The issue stems from improper cleanup of orphaned policy records, which could have been exploited to manipulate approval processes.

Impact

Exploitation of this vulnerability could lead to unauthorized bypassing of merge request approval requirements, potentially allowing users to merge changes without proper oversight.

Remediation

Users can upgrade to GitLab versions 18.11.3, 18.10.6, or 18.9.7 to address this vulnerability.