GitLab has identified a flaw in its access control logic that permits authenticated users to carry out unauthorized actions on merge requests belonging to projects where they lack proper permissions. This vulnerability could let an attacker approve, rebase, modify, or merge requests, thereby compromising the integrity and stability of the codebase.

All GitLab Community and Enterprise Edition releases from version 11.10 up to 18.10.0 are vulnerable. Specifically, any build before 18.8.7, before 18.9.3 in the 18.9 series, or before 18.10.1 in the 18.10 series is affected.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation in the near term. The vulnerability requires an authenticated GitLab user to initiate cross‑repository merge request operations; based on the description, the likely attack vector is an authenticated user exploiting this flaw. The issue is not listed in the CISA KEV catalog, implying it has not yet been widely exploited. Nevertheless, organizations should address the flaw promptly to prevent potential misuse of merge request privileges.