GitLab Enterprise Edition contains a flaw that permits an authenticated user to circumvent merge request approval rules by improperly removing orphaned policy records. The vulnerability stems from missing authorization checks, classified as CWE‑862, and can allow a user whose permissions normally would be restricted from approving or reviewing a merge request to modify or delete approval records, effectively lifting required safeguards. The impact is limited to the integrity of the approval tracking process, exposing the project to unauthorized changes without necessary review.

GitLab version 15.7 through 18.9.6, 18.10.0 through 18.10.5, and 18.11.0 through 18.11.2 are affected. Versions 18.9.7, 18.10.6, 18.11.3 and later are not susceptible.

The CVSS score of 2.6 indicates low severity. EPSS is not available, so current exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploits at this time. The likely attack vector requires an authenticated session, so only users with access credentials can exploit it. In the absence of a public exploit, the risk mainly depends on internal threat actors with legitimate access.