Incorrect Authorization in GitLab

An attacker with Developer permissions creates a merge request containing a benign change, obtains approval from a required CODEOWNER, then force-pushes amended malicious code (e.g., altering `.gitlab-ci.yml` or other production-critical files) to the same branch. Because the approval-removal check does not re-evaluate after the force-push, the existing CODEOWNER approval remains valid, allowing the attacker to merge arbitrary, unapproved code into a protected branch [ref_id=1].

The vulnerability is in GitLab's merge request approval logic when CODEOWNERS are enabled and the "Remove approvals by Code Owners if their files changed" setting is active. The issue is tracked in the GitLab issue tracker [ref_id=1]. The exact file paths are not specified in the advisory, but the bug resides in the approval-removal mechanism that fails to detect force-pushed changes to files covered by CODEOWNERS.

The advisory does not include a published patch diff. The expected correct behavior, as stated in the issue, is that "new code related to CODEOWNERS is pushed, approvals from relevant CODEOWNERS [should be] removed" [ref_id=1]. The fix would need to ensure that any force-push or amendment that changes files covered by CODEOWNERS triggers re-evaluation and removal of prior approvals before the merge is allowed.

1. Create a GitLab repository and add two users: "repo_approver_user" (Developer) and "repo_attacker_user" (Developer). 2. Enable CODEOWNERS and the "Remove approvals by Code Owners if their files changed" setting in repository settings. 3. Push a CODEOWNERS file to the main branch with content `* repo_approver_user`. 4. Make CODEOWNERS approval mandatory for the protected main branch. 5. From "repo_attacker_user", create a new branch "feature_branch", make a safe change, push it, and create a merge request. 6. Have "repo_approver_user" approve the merge request. 7. Locally amend the commit to introduce arbitrary malicious code, then force-push (`git commit --amend && git push -f`). 8. Observe that the approval remains in place, and merge the malicious code into the protected main branch [ref_id=1].