PT-2026-27805 · Gitlab · Gitlab Ce/Ee

Published 2026-03-25 · Updated 2026-03-27 · CVE-2025-14595

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab EE versions 18.6 through 18.8.6 GitLab EE versions 18.9 through 18.9.2 GitLab EE versions 18.10 through 18.10.0

Description An issue existed in GitLab EE where, under specific conditions, an authenticated user possessing the Planner role could view security category metadata and attributes within the group security configuration. This occurred due to insufficient access control measures.

Recommendations Update GitLab EE to version 18.8.7 or later. Update GitLab EE to version 18.9.3 or later. Update GitLab EE to version 18.10.1 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BIT-GITLAB-2025-14595

CVE-2025-14595

Affected Products

Gitlab Ce/Ee

References · 6

• 🔥 https://hackerone.com/reports/3457779 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-14595 · Security Note
• https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2025-14595 · Vendor Advisory
• https://gitlab.com/gitlab-org/gitlab/-/work_items/583971 · Note
• https://twitter.com/CVEnew/status/2036911836336107833 · Twitter Post