Skip to content
OpenAdvisories
High NCSC-2025-0342 7 CVEs

Kwetsbaarheden verholpen in GitLab Enterprise en Community Edition

Published Oct 27, 2025 · Updated Oct 27, 2025 · Revision 2 · nl

Vendor: GitLab Product: GitLab

Summary

GitLab heeft kwetsbaarheden verholpen in GitLab Community Edition (CE) en Enterprise Edition (EE) versies.

Details

Interpretaties
De kwetsbaarheden omvatten de mogelijkheid voor ongeauthenticeerde aanvallers om Denial-of-Service condities te veroorzaken door speciaal samengestelde payloads en GraphQL verzoeken te versturen. Daarnaast konden geauthenticeerde aanvallers ongeautoriseerde pipeline-acties uitvoeren door commits te wijzigen en ongeautoriseerde toegang tot projecten verkrijgen via het goedkeuringsproces van toegang aanvragen. Deze kwetsbaarheden kunnen de integriteit en beschikbaarheid van de systemen in gevaar brengen.

Oplossingen
GitLab heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 7

  • High 8.5
    CVE-2025-11702

    Missing Authorization in GitLab

    GitLab has remediated an issue in EE affecting all versions from 17.1 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker with specific permissions to hijack project runners from other projects.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 7.5
    CVE-2025-10497

    Allocation of Resources Without Limits or Throttling in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to cause a denial of service condition by sending specially crafted …

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 7.5
    CVE-2025-11447

    Allocation of Resources Without Limits or Throttling in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to cause a denial of service condition by sending GraphQL requests wi…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.5
    CVE-2025-11971

    Incorrect Authorization in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 10.6 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker to trigger unauthorized pipeline executions by manipulating commits.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.5
    CVE-2025-11974

    Allocation of Resources Without Limits or Throttling in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to create a denial of service condition by uploading large files to s…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Low 3.7
    CVE-2025-11989

    Missing Authorization in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 17.6.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker to execute unauthorized quick actions by including malicious commands in…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Low 2.7
    CVE-2025-6601

    Business Logic Errors in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.3, and 18.5 before 18.5.1 that under certain conditions could have allowed authenticated users to gain unauthorized project access by exploiting the access request approv…

    GitLab GitLab gitlab Web / CMS Ubuntu

Revision history

  1. #1.0.1

    Foutieve referentie aangepast.

  2. #1.0.0

    Initiele versie

References

  • Reference
    https://about.gitlab.com/releases/2025/10/22/patch-release-gitlab-18-5-1-released/