This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] GitLab CE/EE fixes 7 vulnerabilities
With versions 18.5.1, 18.4.3 and 18.3.5, GitLab fixes 7 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) [1]. The most serious vulnerabilities are listed below.
An authenticated remote attacker with specific privileges can take control of a certain part of another user's project [1].
The vulnerability is present in product:
- GitLab EE; >=17.1, <18.3.5; >=18.4, <18.4.3, >=18.5, <18.5.1;
CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2025-11702 at cve.org, NVD
- CWE-284: Improper Access Control at cwe.mitre.org
The vulnerability was publicly disclosed 22. 10. 2025.
An unauthenticated remote attacker can carry out a DoS attack by sending specially crafted data [1].
The vulnerability is present in product:
- GitLab CE/EE; >=17.10, <18.3.5; >=18.4, <18.4.3, >=18.5, <18.5.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-10497 at cve.org, NVD
- CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org
The vulnerability was publicly disclosed 22. 10. 2025.
An unauthenticated remote attacker can carry out a DoS attack by sending specially crafted GrapgQL requests [1].
The vulnerability is present in product:
- GitLab CE/EE; >=11.0, <18.3.5; >=18.4, <18.4.3, >=18.5, <18.5.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-11447 at cve.org, NVD
- CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org
The vulnerability was publicly disclosed 22. 10. 2025.
By CESNET, z.s.p.o. Martin Krajči on 29. 10. 2025.