PT-2025-43143 · Gitlab · Gitlab Ce/Ee

Published 2025-10-22 · Updated 2025-10-28 · CVE-2025-6601

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions GitLab EE versions 18.4 through 18.4.2 GitLab EE versions 18.5 through 18.5.0

Description GitLab EE is affected by a business logic error in the access request approval workflow. This issue could allow authenticated users to gain unauthorized project access under certain conditions.

Recommendations Update GitLab EE to version 18.4.3 or later. Update GitLab EE to version 18.5.1 or later.

Exploit

Fix

Weakness Enumeration

CWE-840

Related Identifiers

BDU:2025-14929

BIT-GITLAB-2025-6601

CVE-2025-6601

Affected Products

Gitlab Ce/Ee

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/6xxx/CVE-2025-6601.json · Exploit
• 🔥 https://hackerone.com/reports/3209641 · Exploit
• https://cve.org/CVERecord?id=CVE-2025-6601 · Security Note
• https://about.gitlab.com/releases/2025/10/22/patch-release-gitlab-18-5-1-released · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6601 · Security Note
• https://bdu.fstec.ru/vul/2025-14929 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2025-6601 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-6601 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-6601 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-6601 · Vendor Advisory
• https://twitter.com/zoomeye_team/status/1980941411387424898 · Twitter Post
• https://twitter.com/CVEnew/status/1982642926695104825 · Twitter Post
• https://t.me/CVEtracker/35768 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1981481834992025945 · Twitter Post
• https://t.me/cveNotify/140366 · Telegram Post