CVE-2025-2242
Incorrect Authorization in GitLab
Severity Score
7.5
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Track*
*SSVC
Descriptions
An improper access control vulnerability in GitLab CE/EE affecting all versions from 17.4 prior to 17.8.6, 17.9 prior to 17.9.3, and 17.10 prior to 17.10.1 allows a user who was an instance admin before but has since been downgraded to a regular user to continue to maintain elevated privileges to groups and projects.
Una vulnerabilidad de control de acceso inadecuado en GitLab CE/EE que afecta a todas las versiones desde la 17.4 anterior a la 17.8.6, la 17.9 anterior a la 17.9.3 y la 17.10 anterior a la 17.10.1 permite que un usuario que antes era administrador de instancia, pero que desde entonces ha sido degradado a usuario normal, continúe manteniendo privilegios elevados en grupos y proyectos.
*Credits:
This vulnerability was reported by a GitLab customer
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Track*
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2025-03-12 CVE Reserved
- 2025-03-27 CVE Published
- 2025-03-27 CVE Updated
- 2025-03-28 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-863: Incorrect Authorization
CAPEC
References (0)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| GitLab Search vendor "GitLab" | GitLab Search vendor "GitLab" for product "GitLab" | >= 17.4.0 < 17.8.6 Search vendor "GitLab" for product "GitLab" and version " >= 17.4.0 < 17.8.6" | en |
Affected
| ||||||
| GitLab Search vendor "GitLab" | GitLab Search vendor "GitLab" for product "GitLab" | >= 17.9.0 < 17.9.3 Search vendor "GitLab" for product "GitLab" and version " >= 17.9.0 < 17.9.3" | en |
Affected
| ||||||
| GitLab Search vendor "GitLab" | GitLab Search vendor "GitLab" for product "GitLab" | >= 17.10.0 < 17.10.1 Search vendor "GitLab" for product "GitLab" and version " >= 17.10.0 < 17.10.1" | en |
Affected
| ||||||