PT-2025-26936 · Gitlab · Gitlab Ce/Ee

Published 2025-06-25 · Updated 2025-08-12 · CVE-2025-2938

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 17.3 through 17.11.5 GitLab CE/EE versions 18.0 through 18.0.3 GitLab CE/EE versions 18.1 through 18.1.1

Description: An issue has been discovered in GitLab CE/EE that could allow authenticated users to gain elevated project privileges by requesting access to projects where role modifications during the approval process resulted in unintended permission grants. The issue is related to incorrect handling of logical operations within the code collaboration platform.

Recommendations: GitLab CE/EE versions prior to 17.11.5 GitLab CE/EE versions prior to 18.0.3 GitLab CE/EE versions prior to 18.1.1

Exploit

Fix

LPE

Weakness Enumeration

CWE-840

Related Identifiers

BDU:2025-07923

BIT-GITLAB-2025-2938

CVE-2025-2938

Affected Products

Gitlab Ce/Ee

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/2xxx/CVE-2025-2938.json · Exploit
• 🔥 https://hackerone.com/reports/3063091 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-2938 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2025-2938 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-2938 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-2938 · Security Note
• https://osv.dev/vulnerability/CVE-2025-2938 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-07923 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-2938 · Vendor Advisory
• https://twitter.com/CVEnew/status/1938113337847320642 · Twitter Post
• https://gitlab.com/gitlab-org/gitlab/-/issues/529006 · Note
• https://t.me/cveNotify/131817 · Telegram Post
• https://about.gitlab.com/releases/2025/06/25/patch-release-gitlab-18-1-1-released · Note
• https://t.me/cvetracker/27099 · Telegram Post