GitLab Enterprise Edition versions before 18.9.7, 18.10.6, and 18.11.3 contain an access control flaw that lets an authenticated user with developer privileges delete the code owner approval rules on a merge request. Removing these rules removes a mandatory review step, allowing developers to merge changes without the required oversight. The weakness is a classic authorization bypass (CWE‑639) and can undermine governance and compliance processes within the software delivery pipeline.

This issue affects GitLab Enterprise Edition from version 11.10 up through versions prior to 18.9.7, prior to 18.10.6, and prior to 18.11.3. The only affected product line is GitLab EE, with the specifications given by the vendor. All other GitLab products or community editions are not impacted.

The CVSS score is 4.3, indicating moderate impact, and no EPSS score is available, which means the public exploitation likelihood cannot be quantified precisely. The vulnerability is not listed in CISA KEV, suggesting it has not been widely exploited. An attacker must already be authenticated with developer role access, so the attack vector is internal or authenticated. Once the rule is removed, the developer can merge code without required approvals, potentially injecting unreviewed changes into the repository. Given the moderate severity and the requirement for prior access, the overall risk is moderate but should be mitigated promptly to preserve code quality and compliance.