CVE-2025-5069
Description
An issue has been discovered in GitLab CE/EE affecting all versions from 17.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could have allowed an authenticated user to gain unauthorized access to confidential issues by creating a project with an identical name to the victim's project.
Summary dbcve.org
This is an authorization bypass vulnerability in GitLab where an authenticated user can create a project with the same name as an existing project they don't have access to, allowing them to gain unauthorized access to confidential issues in the victim's project. The issue stems from insufficient validation during project creation that may cause name collision or incorrect access control resolution.
Mitigation
Upgrade GitLab to version 18.2.7, 18.3.3, or 18.4.1 or later. Review existing projects for any unauthorized access or name collisions that may have occurred.