Vulnerability Description
An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users to gain elevated project privileges by requesting access to projects where role modifications during the approval process resulted in unintended permission grants.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gitlab | Gitlab | >= 17.3.0, < 17.11.5 |
Related Weaknesses (CWE)
References
- https://gitlab.com/gitlab-org/gitlab/-/issues/529006Broken Link
- https://hackerone.com/reports/3063091Permissions Required
FAQ
What is CVE-2025-2938?
CVE-2025-2938 is a vulnerability with a CVSS score of 3.1 (LOW). An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users to gain elevated pr...
How severe is CVE-2025-2938?
CVE-2025-2938 has been rated LOW with a CVSS base score of 3.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-2938?
Check the references section above for vendor advisories and patch information. Affected products include: Gitlab Gitlab.