diff --git a/extensions/BMO/Extension.pm b/extensions/BMO/Extension.pm
index 6938eb7907..16caecc9a2 100644
--- a/extensions/BMO/Extension.pm
+++ b/extensions/BMO/Extension.pm
@@ -549,8 +549,18 @@ sub bug_check_can_change_field {
     my $user = Bugzilla->user;
 
     if ($field =~ /^cf/ && !@$priv_results && $new_value ne '---') {
+        # Cannot use the standard %cf_setter mapping as we want anyone
+        # to be able to set ?, just not the other values.
+        if ($field eq 'cf_cab_review') {
+            if ($new_value ne '1'
+                && $new_value ne '?'
+                && !$user->in_group('infra', $bug->product_id))
+            {
+                push (@$priv_results, PRIVILEGES_REQUIRED_EMPOWERED);
+            }
+        }
         # "other" custom field setters restrictions
-        if (exists $cf_setters->{$field}) {
+        elsif (exists $cf_setters->{$field}) {
             my $in_group = 0;
             foreach my $group (@{$cf_setters->{$field}}) {
                 if ($user->in_group($group, $bug->product_id)) {
diff --git a/extensions/BMO/lib/Data.pm b/extensions/BMO/lib/Data.pm
index ab9c15353a..d5a87b50a2 100644
--- a/extensions/BMO/lib/Data.pm
+++ b/extensions/BMO/lib/Data.pm
@@ -144,6 +144,11 @@ tie(%$cf_visible_in_products, "Tie::IxHash",
         "Firefox" => [],
         "Toolkit" => [],
     },
+    qr/^cf_cab_review$/ => {
+        "Developer Services"                    => [],
+        "Infrastructure & Operations Graveyard" => [],
+        "Infrastructure & Operations"           => [],
+    }
 );
 
 # Who to CC on particular bugmails when certain groups are added or removed.
diff --git a/extensions/BugModal/lib/WebService.pm b/extensions/BugModal/lib/WebService.pm
index e85225f60c..7a05f263b5 100644
--- a/extensions/BugModal/lib/WebService.pm
+++ b/extensions/BugModal/lib/WebService.pm
@@ -91,11 +91,12 @@ sub edit {
         Bugzilla->active_custom_fields({ product => $bug->product_obj, component => $bug->component_obj });
     foreach my $field (@custom_fields) {
         my $field_name = $field->name;
-        $options{$field_name} = [
-            map { { name => $_->name } }
-            grep { $bug->$field_name eq $_->name || $_->is_active }
-            @{ $field->legal_values }
-        ];
+        my @values = map { { name => $_->name } }
+                     grep { $bug->$field_name eq $_->name
+                            || ($_->is_active
+                                && $bug->check_can_change_field($field_name, $bug->$field_name, $_->name)) }
+                     @{ $field->legal_values };
+        $options{$field_name} = \@values;
     }
 
     # keywords
diff --git a/extensions/BugModal/template/en/default/bug_modal/edit.html.tmpl b/extensions/BugModal/template/en/default/bug_modal/edit.html.tmpl
index eca6f58053..b8c86194c3 100644
--- a/extensions/BugModal/template/en/default/bug_modal/edit.html.tmpl
+++ b/extensions/BugModal/template/en/default/bug_modal/edit.html.tmpl
@@ -736,6 +736,15 @@
       %]
     [% END %]
 
+    [% UNLESS cf_hidden_in_product('cf_cab_review', bug.product, bug.component, bug) %]
+      [% rendered_custom_fields.push('cf_cab_review') %]
+      [% INCLUDE bug_modal/field.html.tmpl
+          field = bug_fields.cf_cab_review
+          field_type = bug_fields.cf_cab_review.type
+          hide_on_view = bug.cf_cab_review == "---"
+      %]
+    [% END %]
+
   [% END %]
   [% WRAPPER fields_rhs %]
 
diff --git a/extensions/BugModal/template/en/default/bug_modal/field.html.tmpl b/extensions/BugModal/template/en/default/bug_modal/field.html.tmpl
index 0c2f59cb0e..bbc7dbb00f 100644
--- a/extensions/BugModal/template/en/default/bug_modal/field.html.tmpl
+++ b/extensions/BugModal/template/en/default/bug_modal/field.html.tmpl
@@ -173,6 +173,7 @@ END;
             [% IF values.defined %]
               [% FOREACH v IN values %]
                 [% NEXT IF NOT v.is_active AND NOT value.contains(v.name).size %]
+                [% NEXT IF NOT bug.check_can_change_field(name, bug.${name}, v.name) %]
                 <option value="[% v.name FILTER html %]"
                         id="v[% v.id FILTER html %]_[% name FILTER html %]"
                         [% " selected" IF value.contains(v.name).size %]
diff --git a/scripts/migrate-cab-review.pl b/scripts/migrate-cab-review.pl
new file mode 100755
index 0000000000..2d6a0c2092
--- /dev/null
+++ b/scripts/migrate-cab-review.pl
@@ -0,0 +1,102 @@
+#!/usr/bin/perl
+
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+# This Source Code Form is "Incompatible With Secondary Licenses", as
+# defined by the Mozilla Public License, v. 2.0.
+
+use strict;
+use warnings;
+
+use FindBin qw($RealBin);
+use lib "$RealBin/../../..";
+
+use Bugzilla;
+use Bugzilla::Bug;
+use Bugzilla::Constants;
+use Bugzilla::Field;
+use Bugzilla::Group;
+use Bugzilla::Install::Util qw(indicate_progress);
+use Bugzilla::User;
+
+Bugzilla->usage_mode(USAGE_MODE_CMDLINE);
+
+my $dbh = Bugzilla->dbh;
+
+# Make all changes as the automation user
+my $auto_user = Bugzilla::User->check({ name => 'automation@bmo.tld' });
+$auto_user->{groups} = [ Bugzilla::Group->get_all ];
+$auto_user->{bless_groups} = [ Bugzilla::Group->get_all ];
+Bugzilla->set_user($auto_user);
+
+# cab-review flag values to custom field values mapping
+my %map = (
+    '?' => '?',
+    '+' => 'approved',
+    '-' => 'denied'
+);
+
+# Verify that all of the custom field values in the mapping data are present
+my $cab_field = Bugzilla::Field->check({ name => 'cf_cab_review' });
+foreach my $value (values %map) {
+    unless (grep($_ eq $value, map { $_->name } @{ $cab_field->legal_values })) {
+        die "Value '$value' does not exist. Please add to 'cf_cab_review.\n";
+    }
+}
+
+# Grab list of bugs with cab-review flag set
+my $sql = <<EOF;
+    SELECT bugs.bug_id
+      FROM bugs JOIN flags ON bugs.bug_id = flags.bug_id
+           JOIN flagtypes ON flags.type_id = flagtypes.id
+     WHERE flagtypes.name = 'cab-review' AND flags.status IN ('?','+', '-')
+     ORDER BY bug_id
+EOF
+
+print "Searching for matching bugs..\n";
+my $bugs = $dbh->selectcol_arrayref($sql);
+my ($current, $total, $updated) = (1, scalar(@$bugs), 0);
+
+die "No matching bugs found\n" unless $total;
+print "About to update $total bugs with cab-review flags set and migrate to the cf_cab_review custom field.\n";
+print "Press <enter> to start, or ^C to cancel...\n";
+<>;
+
+foreach my $bug_id (@$bugs) {
+    indicate_progress({ current => $current++, total => $total, every => 5 });
+
+    # Load bug object
+    my $bug = Bugzilla::Bug->new($bug_id);
+
+    # Find the current cab-review status
+    my $cab_flag;
+    foreach my $flag (@{ $bug->flags }) {
+        next if $flag->type->name ne 'cab-review';
+        $cab_flag = $flag;
+        last;
+    }
+
+    my $timestamp = $dbh->selectrow_array('SELECT LOCALTIMESTAMP(0)');
+
+    $dbh->bz_start_transaction;
+
+    # Set the cab-review custom field to the right status based on the mapped values
+    $bug->set_custom_field($cab_field, $map{$cab_flag->status});
+
+    # Clear the old cab-review flag
+    $bug->set_flags([{ id => $cab_flag->id, status => 'X' }], []);
+
+    # Update the bug
+    $bug->update($timestamp);
+
+    # Do not send email about this change
+    $dbh->do("UPDATE bugs SET delta_ts = ?, lastdiffed = ? WHERE bug_id = ?",
+        undef, $timestamp, $timestamp, $bug_id);
+
+    $dbh->bz_commit_transaction;
+    $updated++;
+}
+
+print "Bugs updated: $updated\n";
diff --git a/template/en/default/bug/field.html.tmpl b/template/en/default/bug/field.html.tmpl
index ba1237dc0a..8667687b2b 100644
--- a/template/en/default/bug/field.html.tmpl
+++ b/template/en/default/bug/field.html.tmpl
@@ -130,6 +130,7 @@
             [% IF field.name.match("^cf_blocking_") OR
                   field.name.match("^cf_status_") OR
                   field.name.match("^cf_tracking_") OR
+                  field.name == "cf_cab_review" OR
                   field.name == "resolution" %]
               [% NEXT UNLESS bug.check_can_change_field(field.name, '---', legal_value.name) OR
                              value.contains(legal_value.name).size %]