CVE-2025-10871

Summary

An issue has been discovered in GitLab EE affecting all versions from 16.6 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1. Project Maintainers can exploit a vulnerability where they can assign custom roles to users with permissions exceeding their own, effectively granting themselves elevated privileges.

Affected Software

VendorProductVersion RangeStatus
GitLabGitLab16.6 < 18.2.7affected
GitLabGitLab18.3 < 18.3.3affected
GitLabGitLab18.4 < 18.4.1affected

Weaknesses

  • CWE-862: CWE-862: Missing Authorization

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References