Skip to content
OpenAdvisories
High WID-SEC-2025-2376 7 CVEs

GitLab: Mehrere Schwachstellen

Published Oct 21, 2025 · Updated Oct 28, 2025 · Revision 3 · de-DE

Summary

Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und einen Denial-of-Service-Zustand auszulösen.

Product

GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.

Vulnerabilities 7

  • High 8.5
    CVE-2025-11702

    Missing Authorization in GitLab

    GitLab has remediated an issue in EE affecting all versions from 17.1 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker with specific permissions to hijack project runners from other projects.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 7.5
    CVE-2025-10497

    Allocation of Resources Without Limits or Throttling in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to cause a denial of service condition by sending specially crafted …

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 7.5
    CVE-2025-11447

    Allocation of Resources Without Limits or Throttling in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to cause a denial of service condition by sending GraphQL requests wi…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.5
    CVE-2025-11971

    Incorrect Authorization in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 10.6 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker to trigger unauthorized pipeline executions by manipulating commits.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.5
    CVE-2025-11974

    Allocation of Resources Without Limits or Throttling in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to create a denial of service condition by uploading large files to s…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Low 3.7
    CVE-2025-11989

    Missing Authorization in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 17.6.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker to execute unauthorized quick actions by including malicious commands in…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Low 2.7
    CVE-2025-6601

    Business Logic Errors in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.3, and 18.5 before 18.5.1 that under certain conditions could have allowed authenticated users to gain unauthorized project access by exploiting the access request approv…

    GitLab GitLab gitlab Web / CMS Ubuntu

Revision history

  1. #3

    Referenz(en) aufgenommen: EUVD-2025-36603

  2. #2

    Referenz(en) aufgenommen: EUVD-2025-35955, EUVD-2025-35956, EUVD-2025-35954, EUVD-2025-35952, EUVD-2025-35953, EUVD-2025-35951

  3. #1

    Initiale Fassung

References