CVE-2025-2498CWE-1220

Insufficient Granularity of Access Control in GitLab

Low · published August 13, 2025

CVSS v3.1
3.1
EPSS
0%
Percentile
17.1
In the wild
Unconfirmed
What it is

An improper access control in Gitlab EE affecting all versions from 12.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2 that under certain conditions could have allowed users to view assigned issues from restricted groups by bypassing IP restrictions.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00263 · 17.1th percentile
Weakness
CWE-1220 · Insufficient Granularity of Access Control
Published
2025-08-13T17:27Z
EPSS history
Timeline
  • 13 AUG 17:27Z
    Insufficient Granularity of Access Control in GitLab
    cvelistv5