Group Access Control Flaw in GitLab CE/EE
CVE-2025-0605

4.3MEDIUM

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
22 May 2025

What is CVE-2025-0605?

A vulnerability in GitLab CE/EE has been identified that allows certain users to bypass two-factor authentication requirements due to improper group access controls. This flaw affects all versions from 16.8 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. If exploited, it could lead to unauthorized access, compromising the security of user accounts. Users should apply available patches to secure their environments against this vulnerability.

Affected Version(s)

GitLab 16.8 < 17.10.7

GitLab 17.11 < 17.11.3

GitLab 18.0 < 18.0.1

References

https://gitlab.com/gitlab-org/gitlab/-/issues/514204
issue-trackingpermissions-required
https://hackerone.com/reports/2919391
technical-descriptionexploitpermissions-required

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks [salh4ckr](https://hackerone.com/salh4ckr) for reporting this vulnerability through our HackerOne bug bounty program
.