MEDIUM

CVE-2025-14592

Gitlab GitLab 2026-02-11 CVSS v3.1

CVSS

5.3

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user to perform unauthorized operations by submitting GraphQL mutations through the GLQL API endpoint.

Summary dbcve.org

GitLab CE/EE versions 18.6 through 18.8.x contained an authorization bypass vulnerability in the GraphQL API (GLQL endpoint) where authenticated users could submit GraphQL mutations that should have been restricted, enabling unauthorized operations.

Mitigation

Upgrade GitLab to version 18.6.6, 18.7.4, 18.8.4 or later. If immediate upgrade is not feasible, restrict or monitor access to the GLQL API endpoint.

Weakness (CWE)

CWE-862 Missing Authorization

EPSS Score

0.26%

Probability of exploitation in next 30 days

18.7th percentile

References

https://about.gitlab.com/releases/2026/02/10/patch-release-gitlab-18-8-4-released/ Release Notes, Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/583961 Broken Link, Issue Tracking https://hackerone.com/reports/3451435 Permissions Required

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE