Low severity3.3NVD Advisory· Published Aug 12, 2026· Updated Aug 19, 2026
CVE-2025-9486
CVE-2025-9486
Description
GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed a user with a pending membership to receive permissions granted by a custom role, due to incorrect privilege assignment that did not account for membership state.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- Range: from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2
- Range: from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2
Patches
Vulnerability mechanics
References
3- docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-2-released/nvdRelease Notes
- gitlab.com/gitlab-org/gitlab/-/issues/565412nvdBroken Link
- hackerone.com/reports/3262844nvdPermissions Required
News mentions
2- GitLab: Nine Vulnerabilities Including XSS and Auth Bypass Patched in Coordinated August 12 ReleaseVypr Intelligence · Aug 12, 2026
- GitLab Patch Release: 19.2.2, 19.1.4, 19.0.6GitLab Security Releases · Aug 12, 2026