PT-2025-41364 · Gitlab · Gitlab Ce/Ee

Brian Williams · Published 2025-10-08 · Updated 2025-10-20 · CVE-2025-11340

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions GitLab EE versions 18.3 through 18.3.4 GitLab EE versions 18.4 through 18.4.2

Description An authorization issue exists in the GitLab EE GraphQL API. Incorrectly scoped GraphQL mutations could allow authenticated users with read-only API tokens to perform unauthorized write operations on vulnerability records under certain conditions. The issue allows for unauthorized modification of vulnerability data.

Recommendations Update GitLab EE from versions 18.3 through 18.3.4 to a newer, fixed version. Update GitLab EE from versions 18.4 through 18.4.2 to a newer, fixed version.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2025-14463

BIT-GITLAB-2025-11340

CVE-2025-11340

Affected Products

Gitlab Ce/Ee

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11340.json · Exploit
• https://bdu.fstec.ru/vul/2025-14463 · Security Note
• https://ubuntu.com/security/CVE-2025-11340 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11340 · Security Note
• https://about.gitlab.com/releases/2025/10/08/patch-release-gitlab-18-4-2-released · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2025-11340 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-11340 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-11340 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11340 · Vendor Advisory
• https://t.me/CVEtracker/34524 · Telegram Post
• https://twitter.com/Netlas_io/status/1976191425554374812 · Twitter Post
• https://twitter.com/ZeroPathLabs/status/1976267623470940592 · Twitter Post
• https://twitter.com/CveTodo/status/1976263968818630724 · Twitter Post
• https://gitlab.com/gitlab-org/gitlab/-/issues/567847 · Note
• https://t.me/cveNotify/139525 · Telegram Post