VYPR
← All advisories
Low severity3.1NVD Advisory· Published Jun 26, 2025· Updated Jun 17, 2026

CVE-2025-2938

CVE-2025-2938

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users to gain elevated project privileges by requesting access to projects where role modifications during the approval process resulted in unintended permission grants.

Affected products

8
  • osv-coords
    pkg:bitnami/gitlab
    Range: >= 17.3.0, < 18.0.1
  • GitLab Inc./GitLab5 versions
    cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*+ 4 more
    • cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*range: >=17.3.0,<17.11.5
    • cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*range: >=17.3.0,<17.11.5
    • cpe:2.3:a:gitlab:gitlab:18.1.0:*:*:*:community:*:*:*
    • cpe:2.3:a:gitlab:gitlab:18.1.0:*:*:*:enterprise:*:*:*
    • cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*range: 17.3
  • GitLab Inc./GitLab EE and CEllm-fuzzy
    Range: from 17.3 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1
  • GitLab Inc./gitlab-org/gitlab-eellm-fuzzy
    Range: from 17.3 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1

Patches

Vulnerability mechanics

References

2

News mentions

1