PT-2025-43136 · Gitlab · Gitlab

Published 2025-10-22 · Updated 2025-11-06 · CVE-2025-11702

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GitLab versions 3.8 through 8.5

Description Multiple vulnerabilities exist in GitLab, including improper access control, denial of service, and incorrect authorization. These issues impact the runner API. A search on Netlas.io using the provided dork and favicon hash may identify potentially affected instances.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2025-13579

BIT-GITLAB-2025-11702

CVE-2025-11702

Affected Products

Gitlab

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11702.json · Exploit
• 🔥 https://hackerone.com/reports/3356284 · Exploit
• https://about.gitlab.com/releases/2025/10/22/patch-release-gitlab-18-5-1-released · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-11702 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-11702 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11702 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-11702 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11702 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2025-11702 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-13579 · Security Note
• https://t.me/cveNotify/140778 · Telegram Post
• https://twitter.com/zoomeye_team/status/1980941411387424898 · Twitter Post
• https://t.me/pentestingnews/69924 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1981494634858569936 · Twitter Post
• https://gitlab.com/gitlab-org/gitlab/-/issues/576900 · Note