GitLab contains a flaw in which an authenticated user can bypass a required merge request approval policy on a protected branch due to improper access control during approval rule synchronization. This flaw allows the attacker to merge code without the approvals that normally protect the branch, giving unauthorized access to modify the codebase and potentially introduce malicious changes. The weakness is a form of Incorrect Access Control identified as CWE-706.

GitLab Enterprise Edition versions from 17.4 up to 19.2.x, plus 19.4 before 19.4.3 and 19.5 before 19.5.1 are affected. All earlier releases extend from 17.4.* up to the stated cut‑off versions. Users of these versions should verify their installation’s exact build number.

The CVSS score of 3.1 indicates a low base severity, and the EPSS score is currently unavailable. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated session and specifically the conditions that trigger approval rule synchronization; it cannot be leveraged from an unauthenticated context. Consequently the likelihood of real‑world exploitation is moderate, but organizations that rely on merge request approvals for gatekeeping should consider the risk significant.