The vulnerability is caused by improper identity resolution in the merge request approval process. This flaw allows an authenticated user who has contributed commits to a merge request to approve it, bypassing the expected review separation. It is an authorization anomaly (CWE‑863) that could let a user merge changes they contributed or are involved in without additional checking.

GitLab Enterprise Edition versions from 16.11 up to 19.1, and the 19.2 line up to the release just before 19.2.8, the 19.3 line up to before 19.3.5, and the 19.4 line up to before 19.4.2 are vulnerable. All newer releases are not affected.

The CVSS score of 4.2 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, so the likelihood of exploitation is uncertain but not considered high. An attacker must be authenticated and possess merge approval rights, limiting the scope to privileged users. Organizations should regard this as a medium‑risk issue that warrants timely remediation.