GitLab CE/EE Vulnerability in GraphQL API Endpoint
CVE-2025-14592

3.7LOW

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
11 February 2026

What is CVE-2025-14592?

A security flaw in GitLab CE/EE versions prior to specific updates allowed authenticated users to exploit GraphQL mutations through the GLQL API endpoint, potentially enabling them to execute unauthorized operations. This vulnerability underscores the importance of maintaining up-to-date software and revising access controls to safeguard against such issues.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

GitLab 18.6 < 18.6.6

GitLab 18.7 < 18.7.4

GitLab 18.8 < 18.8.4

References

https://gitlab.com/gitlab-org/gitlab/-/issues/583961
issue-trackingpermissions-required
https://hackerone.com/reports/3451435
technical-descriptionexploitpermissions-required
https://about.gitlab.com/releases/2026/02/10/patch-releas...

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks [go7f0](https://hackerone.com/go7f0) for reporting this vulnerability through our HackerOne bug bounty program
JSON
.