Riskcovery

CVE-2026-13113

Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab

State
Published
Severity
6.5 Medium
Published
Jul 29, 2026
Updated
Aug 20, 2026
Reserved
Jun 23, 2026

Read the record on cve.org

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to merge code into a protected branch without the required approvals due to a race condition in approval rule processing.

Scores

CVSSScoreVectorSource
3.16.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NGitLab

Weaknesses

  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

Affected Products

ProductVersions
GitLabGitLab
  • 17.0 to before 19.0.5Affected
  • 19.1 to before 19.1.3Affected
  • 19.2 to before 19.2.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.