8.8

CVE-2025-11702

Exploit

EPSS 0.01%
Veröffentlicht 29.10.2025 07:04:52
Zuletzt bearbeitet 03.11.2025 18:32:41
Quelle cve@gitlab.com
CVE-Watchlists
Login
Unerledigt
Login

Missing Authorization in GitLab

GitLab has remediated an issue in EE affecting all versions from 17.1 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker with specific permissions to hijack project runners from other projects.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 6

NVD 3 VulnDex Vulnerability Enrichment 1

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Gitlab ≫ GitLab SwEditionenterprise Version >= 17.1.0 < 18.3.5

Gitlab ≫ GitLab SwEditionenterprise Version >= 18.4.0 < 18.4.3

Gitlab ≫ GitLab Version18.5.0 SwEditionenterprise

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.01%	0.017

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	8.8	2.8	5.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cve@gitlab.com	8.5	1.8	6	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://about.gitlab.com/releases/2025/10/22/patch-release-gitlab-18-5-1-released/

Vendor Advisory

Release Notes

https://gitlab.com/gitlab-org/gitlab/-/issues/576900

Broken Link

https://hackerone.com/reports/3356284

Permissions Required

https://nvd.nist.gov/vuln/detail/CVE-2025-11702

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2025-11702

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2025-11702

EUVD