PT-2025-30917 · Gitlab+1 · Gitlab Ce/Ee+1

Published 2025-07-25 · Updated 2025-10-01 · CVE-2025-10871

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GitLab EE versions 16.6 through 18.2.7 GitLab EE versions 18.3 through 18.3.3 GitLab EE versions 18.4 through 18.4.1 sudo (affected versions not specified)

Description A security issue exists in GitLab EE where Project Maintainers can assign custom roles to users, potentially granting themselves elevated privileges beyond their authorized access level. In sudo on OracleLinux 7, a heap overflow can lead to local privilege escalation to root via exploitation of the -s flag.

Recommendations Update GitLab EE to version 18.2.8 or later. Update GitLab EE to version 18.3.4 or later. Update GitLab EE to version 18.4.2 or later. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BIT-GITLAB-2025-10871

CVE-2025-10871

Affected Products

Gitlab Ce/Ee

Sudo

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/10xxx/CVE-2025-10871.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-10871 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2025-10871 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-10871 · Security Note
• https://gitlab.com/gitlab-org/gitlab/-/issues/569482 · Note
• https://twitter.com/CVEnew/status/1971539548501844328 · Twitter Post
• https://t.me/cveNotify/136512 · Telegram Post
• https://twitter.com/Cezar_H_Linux/status/1948804933270049128 · Twitter Post