Privilege Escalation in GitLab EE Affecting Multiple Versions
CVE-2025-9486

3.3LOW

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
12 August 2026

What is CVE-2025-9486?

A privilege escalation vulnerability exists in GitLab EE, allowing users with pending memberships to receive permissions from a custom role due to incorrect privilege assignments. This issue affects multiple GitLab EE versions and poses a significant risk by potentially granting unauthorized access based on membership states. Remediation has been implemented in subsequent patches.

Affected Version(s)

GitLab 15.6 < 19.0.6

GitLab 19.1 < 19.1.4

GitLab 19.2 < 19.2.2

References

https://gitlab.com/gitlab-org/gitlab/-/issues/565412
issue-trackingpermissions-required
https://hackerone.com/reports/3262844
technical-descriptionexploitpermissions-required
https://docs.gitlab.com/releases/patches/patch-release-gi...

CVSS V3.1

Score:
3.3
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks [mateuszek](https://hackerone.com/mateuszek) for reporting this vulnerability through our HackerOne bug bounty program
.