External User Permissions Issue in GitLab CE/EE Products
CVE-2025-1540

3.1LOW

Key Information:

Vendor
Gitlab
Status
Gitlab
Vendor
CVE Published:
6 March 2025

Summary

A permission manipulation issue has been identified in GitLab CE/EE that affects self-managed and dedicated instances. This vulnerability allows users designated as External to improperly access and replicate internal projects in specific scenarios. The flaw spans multiple versions, including all releases from 17.5 up to 17.6.5, 17.7 up to 17.7.4, and 17.8 up to 17.8.2, posing a risk to sensitive project data. Immediate attention is warranted to mitigate potential information exposure.

Affected Version(s)

GitLab 17.5 < 17.6.5

GitLab 17.7 < 17.7.4

GitLab 17.8 < 17.8.2

References

https://gitlab.com/gitlab-org/gitlab/-/issues/512765
issue-trackingpermissions-required
https://about.gitlab.com/releases/2025/02/12/patch-releas...

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks [Renato Alves](https://gitlab.com/unode) for reporting this vulnerability.
.