PT-2026-27805 · Gitlab · Gitlab Ce/Ee

CVE-2025-14595 · Publicado 2026-03-25 · Atualizado 2026-03-27

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab EE versions 18.6 through 18.8.6 GitLab EE versions 18.9 through 18.9.2 GitLab EE versions 18.10 through 18.10.0

Description An issue existed in GitLab EE where, under specific conditions, an authenticated user possessing the Planner role could view security category metadata and attributes within the group security configuration. This occurred due to insufficient access control measures.

Recommendations Update GitLab EE to version 18.8.7 or later. Update GitLab EE to version 18.9.3 or later. Update GitLab EE to version 18.10.1 or later.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

BIT-GITLAB-2025-14595

CVE-2025-14595

Produtos afetados

Gitlab Ce/Ee

Referências · 6

• 🔥 https://hackerone.com/reports/3457779 · Exploit
• https://gitlab.com/gitlab-org/gitlab/-/work_items/583971 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-14595 · Nota de Segurança
• https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2036911836336107833 · Publicação no Twitter
• https://osv.dev/vulnerability/BIT-gitlab-2025-14595 · Aviso do Fabricante