MEDIUM

CVE-2025-14560

Gitlab GitLab 2026-02-11 CVSS v3.1

CVSS

5.4

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.1 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user to perform unauthorized actions on behalf of another user by injecting malicious content into vulnerability code flow.

Summary dbcve.org

An authenticated user could inject malicious content into GitLab's vulnerability code flow, enabling them to perform unauthorized actions on behalf of another user. This represents an authorization bypass through content injection in the vulnerability tracking functionality.

Mitigation

Upgrade GitLab to version 18.6.6, 18.7.4, 18.8.4 or later to receive the patch.

Weakness (CWE)

CWE-79 Cross-site Scripting (XSS)

EPSS Score

0.23%

Probability of exploitation in next 30 days

13.6th percentile

References

https://about.gitlab.com/releases/2026/02/10/patch-release-gitlab-18-8-4-released/ Release Notes, Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/583861 Broken Link, Issue Tracking https://hackerone.com/reports/3461083 Permissions Required

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE