← Back

CVE-2025-5121

nvd nist
Published: Jun 20, 2025Modified: Aug 12, 2025

JSON object

Loading...
9.9
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Exploitability: 3.1 / Impact: 6.0
Source: NVD

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 17.11 before 17.11.4 and 18.0 before 18.0.2. A missing authorization check may have allowed compliance frameworks to be applied to projects outside the compliance framework's group.

Affected (4)

Products: Gitlab: Gitlab
Gitlab
1 product
Gitlab
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Gitlab
Gitlab
From 17.11.0 to 17.11.4
Gitlab
From 18.0.0 to 18.0.2
Gitlab
From 17.11.0 to 17.11.4
Gitlab
From 18.0.0 to 18.0.2

Related CWEs

CWE-862
Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (2)

Source: cve@gitlab.com
Broken Link
Source: cve@gitlab.com
Permissions Required

Timeline

No history available yet.