An improper access control vulnerability in GitLab CE/EE affecting all versions from 17.4 prior to 17.8.6, 17.9 prior to 17.9.3, and 17.10 prior to 17.10.1 allows a user who was an instance admin before but has since been downgraded to a regular user to continue to maintain elevated privileges to groups and projects.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Gitlab |
|
Configuration 1 [-]
|
No data.
No data.
References
| Link | Providers |
|---|---|
| https://gitlab.com/gitlab-org/gitlab/-/issues/516271 |
|
History
Wed, 13 Aug 2025 01:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* cpe:2.3:a:gitlab:gitlab:17.10.0:*:*:*:community:*:*:* cpe:2.3:a:gitlab:gitlab:17.10.0:*:*:*:enterprise:*:*:* |
Thu, 27 Mar 2025 13:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Thu, 27 Mar 2025 12:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An improper access control vulnerability in GitLab CE/EE affecting all versions from 17.4 prior to 17.8.6, 17.9 prior to 17.9.3, and 17.10 prior to 17.10.1 allows a user who was an instance admin before but has since been downgraded to a regular user to continue to maintain elevated privileges to groups and projects. | |
| Title | Incorrect Authorization in GitLab | |
| First Time appeared |
Gitlab
Gitlab gitlab |
|
| Weaknesses | CWE-863 | |
| CPEs | cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Gitlab
Gitlab gitlab |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: GitLab
Published:
Updated: 2025-03-27T13:11:00.331Z
Reserved: 2025-03-12T08:02:47.810Z
Link: CVE-2025-2242
Vulnrichment
Updated: 2025-03-27T13:10:56.407Z
NVD
Status : Analyzed
Published: 2025-03-27T13:15:36.387
Modified: 2025-08-13T01:13:26.560
Link: CVE-2025-2242
Redhat
No data.
OpenCVE Enrichment
No data.