Description
An issue has been discovered in GitLab EE affecting all versions from 16.6 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1. Project Maintainers can exploit a vulnerability where they can assign custom roles to users with permissions exceeding their own, effectively granting themselves elevated privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GitLab | GitLab | 16.6 – < 18.2.7, 18.3 – < 18.3.3, 18.4 – < 18.4.1 | 18.2.7 |
Advisories 2
- WID-SEC-2025-2140 GitLab: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 27, 2025
- NCSC-2025-0300 Kwetsbaarheden verholpen in GitLab EE & CE NCSC-NL (Netherlands) · Sep 29, 2025
References
- GitLab Issue #569482 issue-tracking permissions-required