EUVD-2025-28396CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionNVD
An issue has been discovered in GitLab CE/EE affecting all versions from 17.11 before 17.11.4 and 18.0 before 18.0.2. A missing authorization check may have allowed compliance frameworks to be applied to projects outside the compliance framework's group.
AnalysisAI
GitLab CE/EE contains a missing authorization check (CWE-862) in its compliance frameworks feature that allows authenticated users with limited privileges to apply compliance frameworks to projects outside the intended scope of the framework's group, potentially affecting confidentiality, integrity, and availability. This vulnerability affects GitLab versions 17.11 before 17.11.4 and 18.0 before 18.0.2. The CVSS 8.5 score reflects high severity due to the scope change and multiple impact categories, though exploitation requires low-level user authentication and higher-than-typical attack complexity.
Technical ContextAI
GitLab's compliance frameworks feature allows administrators to define and enforce compliance policies at the group level. The vulnerability stems from inadequate authorization validation (CWE-862: Missing Authorization) in the compliance framework application logic, failing to properly verify that a user attempting to apply a framework to a project has the requisite permissions over both the framework's source group and the target project. This authorization bypass operates at the API/application layer, allowing privilege escalation within the GitLab instance. The affected products are GitLab Community Edition (CE) and Enterprise Edition (EE), which are web-based DevOps platforms built in Ruby on Rails. The flaw likely exists in the compliance framework controller or service layer responsible for validating scope boundaries before framework application.
RemediationAI
Immediate remediation: upgrade GitLab to version 17.11.4 or 18.0.2 (or later stable releases). For organizations unable to immediately patch: (1) restrict compliance framework management permissions to trusted administrators only; (2) audit compliance framework application logs to identify any unauthorized cross-group/cross-project applications; (3) implement network-level access controls to limit who can access GitLab API endpoints related to compliance frameworks; (4) disable compliance frameworks feature temporarily if not critical to operations. Refer to GitLab's official security advisory for detailed patching instructions and rollout guidance specific to your deployment (self-managed vs. SaaS).
More from same product – last 7 days
Command injection in Prefect 3.6.18's GitHub integration allows authenticated users to execute arbitrary git commands th
Incorrect authorization enforcement in GitLab CE/EE permits a blocked Project Access Token to continue reading private p
Identity confusion in GitLab EE's Duo AI workflow runners lets an authenticated, low-privileged user cause specific Duo
Denial of service in GitLab CE/EE affects all versions from 17.1 through those prior to 18.10.7, 18.11.4, and 19.0.1, al
Unauthorized private project enumeration in GitLab CE/EE exposes confidential project metadata to unauthenticated networ
Vendor StatusVendor
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| xenial | ignored | - |
| jammy | DNE | - |
| noble | DNE | - |
| oracular | DNE | - |
| plucky | DNE | - |
| upstream | needs-triage | - |
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| sid | vulnerable | 17.6.5-19 | - |
| (unstable) | fixed | (unfixed) | - |
Share
External POC / Exploit Code
Leaving vuln.today