CVE-2025-5121 HIGH

CVE-2025-5121: Missing Authorization in GitLab

Vendor Gitlab
Product GitLab
Weakness CWE-862 · Missing authorization
Published June 20, 2025
Last update June 20, 2025
View on NVD All CVEs

CVSS base score

8.5/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

An issue has been discovered in GitLab CE/EE affecting all versions from 17.11 before 17.11.4 and 18.0 before 18.0.2. A missing authorization check may have allowed compliance frameworks to be applied to projects outside the compliance framework's group.

Key dates

02Disclosure timeline

June 20, 2025 CVE published
June 20, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-44012 Craft CMS: Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure CVE-2025-11158 Hitachi Vantara Pentaho Data Integration & Analytics - Missing Authorization CVE-2023-52227 WordPress MailerLite – WooCommerce integration plugin <= 2.0.8 - Broken Access Control vulnerability CVE-2026-32395 WordPress Xpro Addons For Beaver Builder – Lite plugin <= 1.5.6 - Broken Access Control vulnerability CVE-2026-25401 WordPress WPCargo Track & Trace plugin <= 8.0.2 - Broken Access Control vulnerability