Vulnerability · Published Feb 2, 2026 · Assigned by GitLab
CVE-2026-1751Missing Authorization in GitLab
Low 3.1
In plain English
A low-severity missing authorization in GitLab from GitLab. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Severity (CVSS 3.1)3.1Low
Exploit odds (30 days)0.2%top 85.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability has been discovered in GitLab CE/EE affecting all versions starting with 16.8 before 18.5.0 that could have allowed unauthorized edits to merge request approval rules under certain conditions.
Affected products (as reported)
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
References
- GitLab Issue #519340 issue-tracking, permissions-required
- HackerOne Bug Bounty Report #2980839 technical-description, exploit, permissions-required