CVE-2025-9486CWE-266

CVE-2025-9486

Low · published August 13, 2026

CVSS v3.1
3.3
EPSS
0%
Percentile
26.3
In the wild
Unconfirmed
What it is

GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed a user with a pending membership to receive permissions granted by a custom role, due to incorrect privilege assignment that did not account for membership state.

The record
Technical detail
CVSS v3.1
3.3 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00341 · 26.3th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2026-08-13T00:17Z
Affected products (3)
ProductVersionsFixed in
gitlab/gitlab≥ 15.6.0, < 19.0.619.0.6
gitlab/gitlab≥ 19.1.0, < 19.1.419.1.4
gitlab/gitlab≥ 19.2.0, < 19.2.219.2.2
References (3)
https://gitlab.com/gitlab-org/gitlab/-/issues/565412 · [email protected]https://hackerone.com/reports/3262844 · [email protected]https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-2-released/ · [email protected]
EPSS history
Timeline
  • 12 AUG 19:05Z
    Incorrect Privilege Assignment in GitLab
    cvelistv5