CVE-2026-13113

Analyzed Analyzed - Analysis Complete

Race Condition in GitLab EE Allows Unauthorized Branch Merges

Publication date: 2026-07-29

Last updated on: 2026-08-03

Assigner: GitLab Inc.

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to merge code into a protected branch without the required approvals due to a race condition in approval rule processing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-08-03

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-13113

Affected Vendors & Products

Vendor	Product	Version / Range
gitlab	gitlab	From 19.1.0 (inc) to 19.1.3 (exc)
gitlab	gitlab	19.2.0
gitlab	gitlab	From 17.0.0 (inc) to 19.0.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

Executive Summary

This vulnerability in GitLab EE allows an authenticated user to merge code into a protected branch without required approvals due to a race condition in approval rule processing. It affects versions from 17.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1.

Detection Guidance

This vulnerability involves a race condition in GitLab EE's approval rule processing. To detect it, check GitLab logs for unusual merge requests into protected branches without required approvals. Look for patterns where approvals were bypassed despite branch protection rules. Review audit logs for merge events and compare them against approval rule configurations.

Impact Analysis

An attacker with access could bypass approval requirements and merge unauthorized code into protected branches, potentially leading to code execution, data breaches, or compliance violations.

Compliance Impact

This vulnerability could lead to unauthorized code changes, potentially violating integrity controls required by GDPR and HIPAA, resulting in non-compliance and legal penalties.

Mitigation Strategies

Upgrade GitLab EE to a patched version (19.0.5, 19.1.3, or 19.2.1 or later) immediately. Verify that branch protection rules are correctly enforced and approval requirements are properly configured. Monitor merge requests closely until the upgrade is complete.

Hi! I’m here to help you understand CVE-2026-13113. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70