CVE-2025-5121CWE-862

Missing Authorization in GitLab

High · published June 20, 2025

CVSS v3.1

8.5

EPSS

12%

Percentile

96.2

In the wild

Unconfirmed

What it is

An issue has been discovered in GitLab CE/EE affecting all versions from 17.11 before 17.11.4 and 18.0 before 18.0.2. A missing authorization check may have allowed compliance frameworks to be applied to projects outside the compliance framework's group.

The record

Technical detail

CVSS v3.1: 8.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.12436 · 96.2th percentile
Weakness: CWE-862 · Missing Authorization
Published: 2025-06-20T17:12Z

EPSS history

Timeline

20 JUN 17:12Z
Missing Authorization in GitLab
cvelistv5