PT-2025-47047 · Gitlab · Gitlab Ce/Ee

Published 2025-11-12 · Updated 2025-11-15 · CVE-2025-11865

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions GitLab EE versions 18.1 through 18.3.6 GitLab EE versions 18.4 through 18.4.4 GitLab EE versions 18.5 through 18.5.2

Description A security issue exists in GitLab EE that, under specific conditions, could allow an attacker to remove Duo multi-factor authentication flows belonging to another user.

Recommendations Update GitLab EE to version 18.3.6 or later. Update GitLab EE to version 18.4.4 or later. Update GitLab EE to version 18.5.2 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2025-14458

BIT-GITLAB-2025-11865

CVE-2025-11865

Affected Products

Gitlab Ce/Ee

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11865.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-11865 · Vendor Advisory
• https://about.gitlab.com/releases/2025/11/12/patch-release-gitlab-18-5-2-released · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11865 · Security Note
• https://bdu.fstec.ru/vul/2025-14458 · Security Note
• https://twitter.com/VulmonFeeds/status/1989624710913516020 · Twitter Post
• https://t.me/cveNotify/142911 · Telegram Post
• https://twitter.com/CVEnew/status/1989608990737862882 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11865 · Note
• https://t.me/CVEtracker/37415 · Telegram Post
• https://gitlab.com/gitlab-org/gitlab/-/issues/561399 · Note