EUVD-2025-28396
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
4Description
An issue has been discovered in GitLab CE/EE affecting all versions from 17.11 before 17.11.4 and 18.0 before 18.0.2. A missing authorization check may have allowed compliance frameworks to be applied to projects outside the compliance framework's group.
Analysis
GitLab CE/EE contains a missing authorization check (CWE-862) in its compliance frameworks feature that allows authenticated users with limited privileges to apply compliance frameworks to projects outside the intended scope of the framework's group, potentially affecting confidentiality, integrity, and availability. This vulnerability affects GitLab versions 17.11 before 17.11.4 and 18.0 before 18.0.2. The CVSS 8.5 score reflects high severity due to the scope change and multiple impact categories, though exploitation requires low-level user authentication and higher-than-typical attack complexity.
Technical Context
GitLab's compliance frameworks feature allows administrators to define and enforce compliance policies at the group level. The vulnerability stems from inadequate authorization validation (CWE-862: Missing Authorization) in the compliance framework application logic, failing to properly verify that a user attempting to apply a framework to a project has the requisite permissions over both the framework's source group and the target project. This authorization bypass operates at the API/application layer, allowing privilege escalation within the GitLab instance. The affected products are GitLab Community Edition (CE) and Enterprise Edition (EE), which are web-based DevOps platforms built in Ruby on Rails. The flaw likely exists in the compliance framework controller or service layer responsible for validating scope boundaries before framework application.
Affected Products
GitLab Community Edition (CE) and Enterprise Edition (EE): versions 17.11.0 through 17.11.3 (inclusive) and versions 18.0.0 through 18.0.1 (inclusive). Patched versions: 17.11.4 and 18.0.2 or later. CPE approximation: cpe:2.7:a:gitlab:gitlab:*:*:*:*:community:*:* and cpe:2.7:a:gitlab:gitlab:*:*:*:*:enterprise:*:* for affected version ranges. Users on versions prior to 17.11 (e.g., 17.10.x and earlier) are not affected based on the description.
Remediation
Immediate remediation: upgrade GitLab to version 17.11.4 or 18.0.2 (or later stable releases). For organizations unable to immediately patch: (1) restrict compliance framework management permissions to trusted administrators only; (2) audit compliance framework application logs to identify any unauthorized cross-group/cross-project applications; (3) implement network-level access controls to limit who can access GitLab API endpoints related to compliance frameworks; (4) disable compliance frameworks feature temporarily if not critical to operations. Refer to GitLab's official security advisory for detailed patching instructions and rollout guidance specific to your deployment (self-managed vs. SaaS).
Priority Score
Vendor Status
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| xenial | ignored | - |
| jammy | DNE | - |
| noble | DNE | - |
| oracular | DNE | - |
| plucky | DNE | - |
| upstream | needs-triage | - |
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| sid | vulnerable | 17.6.5-19 | - |
| (unstable) | fixed | (unfixed) | - |
Share
External POC / Exploit Code
Leaving vuln.today