The vulnerability is a time‑of‑check time‑of‑use race condition in how GitLab processes approval rules during a merge to a protected branch. An authenticated user who can initiate a merge could, by exploiting the condition, merge code before the approval requirement is enforced. This allows the user to bypass mandatory approvals, potentially inserting malicious or unstable changes into the protected code base. The weakness is identified as CWE‑367.

Affected systems are GitLab Enterprise Edition installations. All releases from 17.0 up to (but excluding) 19.0.5, from 19.1 up to 19.1.3, and from 19.2 up to 19.2.1 are vulnerable. Users whose installations fall within those ranges should consider themselves impacted. The official CNA remedy is to upgrade to GitLab 19.0.5, 19.1.3, 19.2.1 or any newer release, which includes the fix for this race condition.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation, and the vulnerability is not listed in CISA's KEV catalog. The attack vector would require authenticated access with merge capability on a protected branch; the condition exploits a race between checking approval status and performing the merge. While exploitation is unlikely to be widespread, the potential to alter protected code without approval warrants prompt remediation.