Description
An issue has been discovered in GitLab CE/EE affecting all versions from 16.8 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Group access controls could allow certain users to bypass two-factor authentication requirements.
Published: 2025-05-22
Score: 4.6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

Vendor Solution

Upgrade to versions 17.10.7, 17.11.3, 18.0.1 or above.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-16150 An issue has been discovered in GitLab CE/EE affecting all versions from 16.8 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Group access controls could allow certain users to bypass two-factor authentication requirements.
History

Thu, 29 May 2025 16:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-287
CPEs cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:18.0.0:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:18.0.0:*:*:*:enterprise:*:*:*

Thu, 22 May 2025 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 May 2025 14:45:00 +0000

Type Values Removed Values Added
Description An issue has been discovered in GitLab CE/EE affecting all versions from 16.8 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Group access controls could allow certain users to bypass two-factor authentication requirements.
Title Weak Authentication in GitLab
First Time appeared Gitlab
Gitlab gitlab
Weaknesses CWE-1390
CPEs cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
Vendors & Products Gitlab
Gitlab gitlab
References
Metrics cvssV3_1

{'score': 4.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N'}

Subscriptions

Gitlab Gitlab
cve-icon MITRE

Status: PUBLISHED

Assigner: GitLab

Published:

Updated: 2025-05-22T14:45:03.172Z

Reserved: 2025-01-20T12:30:47.553Z

Link: CVE-2025-0605

cve-icon Vulnrichment

Updated: 2025-05-22T14:44:57.737Z

cve-icon NVD

Status : Analyzed

Published: 2025-05-22T15:16:03.957

Modified: 2025-05-29T15:58:07.703

Link: CVE-2025-0605

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses