PT-2025-25366 · Gitlab · Gitlab Ce/Ee

Published 2025-06-11 · Updated 2025-08-12 · CVE-2025-5121

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GitLab Enterprise Edition (EE) (affected versions not specified)

Description The issue is related to insufficient authorization procedures in the GitLab Enterprise Edition platform, which can be exploited by a remote attacker to gain read and modify access to data. It has been noted that a missing authorization flaw permitted attackers to inject malicious jobs into future pipelines, risking unauthorized code execution, but this required authenticated access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2025-06828

BIT-GITLAB-2025-5121

CVE-2025-5121

Affected Products

Gitlab Ce/Ee

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/5xxx/CVE-2025-5121.json · Exploit
• 🔥 https://hackerone.com/reports/3153908 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-5121 · Security Note
• https://osv.dev/vulnerability/CVE-2025-5121 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2025-5121 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06828 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-5121 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-5121 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-5121 · Vendor Advisory
• https://twitter.com/gossy_84/status/1933509825024889284 · Twitter Post
• https://t.me/cveNotify/131812 · Telegram Post
• https://t.me/cvetracker/26684 · Telegram Post
• https://twitter.com/CveFindCom/status/1936116940512088214 · Twitter Post
• https://twitter.com/socradar/status/1933494561298325736 · Twitter Post
• https://gitlab.com/gitlab-org/gitlab/-/issues/545429 · Note