PT-2025-39627 · Gitlab · Gitlab Ce/Ee

Published 2025-09-25 · Updated 2025-10-01 · CVE-2025-7691

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GitLab EE versions 16.6 through 18.2.6 GitLab EE versions 18.3 through 18.3.2 GitLab EE versions 18.4 through 18.4.0

Description A privilege escalation issue exists in GitLab EE. A developer possessing specific group management permissions may be able to escalate their privileges and gain unauthorized access to system capabilities.

Recommendations Update GitLab EE to version 18.2.7 or later. Update GitLab EE to version 18.3.3 or later. Update GitLab EE to version 18.4.1 or later.

Exploit

Fix

LPE

Weakness Enumeration

CWE-267

Related Identifiers

BDU:2025-12404

BIT-GITLAB-2025-7691

CVE-2025-7691

Affected Products

Gitlab Ce/Ee

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/7xxx/CVE-2025-7691.json · Exploit
• 🔥 https://hackerone.com/reports/3200469 · Exploit
• https://osv.dev/vulnerability/BIT-gitlab-2025-7691 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-7691 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-12404 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-7691 · Security Note
• https://twitter.com/CVEnew/status/1971539543426740502 · Twitter Post
• https://about.gitlab.com/releases/2025/09/25/patch-release-gitlab-18-4-1-released · Note
• https://gitlab.com/gitlab-org/gitlab/-/issues/555786 · Note
• https://t.me/CVEtracker/33449 · Telegram Post