CVE-2025-6601

CVE-2025-6601

Low · published October 27, 2025

CVSS v3.1
2.7
EPSS
0%
Percentile
23.7
In the wild
Unconfirmed
What it is

GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.3, and 18.5 before 18.5.1 that under certain conditions could have allowed authenticated users to gain unauthorized project access by exploiting the access request approval workflow.

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00320 · 23.7th percentile
Published
2025-10-27T04:15Z
Affected products (2)
ProductVersionsFixed in
gitlab/gitlab≥ 18.4.0, < 18.4.318.4.3
gitlab/gitlaball versions—
References (3)
https://about.gitlab.com/releases/2025/10/22/patch-release-gitlab-18-5-1-released/ · [email protected]https://gitlab.com/gitlab-org/gitlab/-/issues/551267 · [email protected]https://hackerone.com/reports/3209641 · [email protected]
EPSS history
Timeline
  • 27 OCT 00:06Z
    Business Logic Errors in GitLab
    cvelistv5