CVE-2025-10871

Published: Sep 26, 2025Modified: Sep 29, 2025

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

An issue has been discovered in GitLab EE affecting all versions from 16.6 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1. Project Maintainers can exploit a vulnerability where they can assign custom roles to users with permissions exceeding their own, effectively granting themselves elevated privileges.

Affected (6)

Products: Gitlab: Gitlab

Gitlab

1 product

Gitlab

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Gitlab Gitlab	From 16.6.0 to 18.2.7
Gitlab Gitlab	From 18.3.0 to 18.3.3
Gitlab Gitlab	From 16.6.0 to 18.2.7
Gitlab Gitlab	From 18.3.0 to 18.3.3
Gitlab Gitlab	Version 18.4.0
Gitlab Gitlab	Version 18.4.0

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (1)

https://gitlab.com/gitlab-org/gitlab/-/issues/569482

Source: cve@gitlab.com

Broken Link

Timeline

No history available yet.