PT-2026-7520 · Gitlab · Gitlab Ce/Ee

Published 2026-02-10 · Updated 2026-02-16 · CVE-2025-14560

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 17.1 through 18.6.6 GitLab CE/EE versions 18.7 through 18.7.4 GitLab CE/EE versions 18.8 through 18.8.4

Description An issue existed in GitLab CE/EE that, under specific circumstances, could allow an authenticated user to perform unauthorized actions as another user. This was possible through the injection of malicious content into the vulnerability code flow.

Recommendations Update GitLab CE/EE to version 18.6.7 or later. Update GitLab CE/EE to version 18.7.4 or later. Update GitLab CE/EE to version 18.8.4 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-01824

BIT-GITLAB-2025-14560

CVE-2025-14560

Affected Products

Gitlab Ce/Ee

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/14xxx/CVE-2025-14560.json · Exploit
• 🔥 https://hackerone.com/reports/3461083 · Exploit
• https://about.gitlab.com/releases/2026/02/10/patch-release-gitlab-18-8-4-released · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-14560 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-14560 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14560 · Security Note
• https://ubuntu.com/security/CVE-2025-14560 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2025-14560 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-01824 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-14560 · Security Note
• https://gitlab.com/gitlab-org/gitlab/-/issues/583861 · Note
• https://twitter.com/CVEnew/status/2021554572519440736 · Twitter Post
• https://twitter.com/CCBalert/status/2022242799131746743 · Twitter Post
• https://twitter.com/cracbot/status/2023351726615802118 · Twitter Post