Authorization Check Issue in GitLab CE/EE
CVE-2025-5121

8.5HIGH

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
20 June 2025

Badges

đź“° News Worthy

What is CVE-2025-5121?

A vulnerability exists in GitLab CE/EE that can lead to unauthorized application of compliance frameworks to projects outside their intended groups. This flaw arises from a missing authorization check, potentially compromising project compliance integrity and allowing for improper access to sensitive compliance features. Users should be aware of this risk, particularly in versions prior to 17.11.4 and 18.0.2, and should take immediate action to patch their installations.

Affected Version(s)

GitLab 17.11 < 17.11.4

GitLab 18.0 < 18.0.2

News Articles

favicon imageBleepingComputer

GitLab patches high severity account takeover, missing auth issues

GitLab has released security updates to address multiple vulnerabilities in the company's DevSecOps platform, including ones enabling attackers to take over accounts and inject malicious jobs in future pipelines.

1 week ago

References

https://gitlab.com/gitlab-org/gitlab/-/issues/545429
issue-trackingpermissions-required
https://hackerone.com/reports/3153908
technical-descriptionexploitpermissions-required

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • đź“°

    First article discovered by BleepingComputer

  • Vulnerability Reserved

Credit

Thanks [jean_d-ou](https://hackerone.com/jean_d-ou) for reporting this vulnerability through our HackerOne bug bounty program
.
CVE-2025-5121 : Authorization Check Issue in GitLab CE/EE