CVE-2025-0516 — Incorrect Authorization in Gitlab

CWE-863 — Incorrect AuthorizationCWE-200 — Sensitive Information Exposure6 documents6 sources
Severity
4.3MEDIUMNVD
EPSS
0.0%
top 92.31%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
GitlabDebian GitlabGitlab CE+2 more
Timeline
PublishedFeb 12

Description

Improper Authorization in GitLab CE/EE affecting all versions from 17.7 prior to 17.7.4, 17.8 prior to 17.8.2 allow users with limited permissions to perform unauthorized actions on critical project data.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages7 packages

▶CVEListV5gitlab/gitlab17.7 — 17.7.4+1
▶NVDgitlab/gitlab17.7.0 — 17.7.4+1
▶debiandebian/gitlab
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
GHSA
GHSA-7wc9-4gpr-w6xx: Improper Authorization in GitLab CE/EE affecting all versions from 17↗2025-02-12
▶
OSV
CVE-2025-0516: Improper Authorization in GitLab CE/EE affecting all versions from 17↗2025-02-12
▶

📋Vendor Advisories

3
GitLab
CVE-2025-0516: Improper Authorization in GitLab CE/EE affecting all versions from 17.7 prior to 17.7.4, 17.8 prior to 17.8.2 allow users with limited permissions to↗2025-02-12
▶
Debian
CVE-2025-0516: gitlab - Improper Authorization in GitLab CE/EE affecting all versions from 17.7 prior to...↗2025
▶
Microsoft
A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for s390 in the Linux kernel. This flaw allows a local attacker with a normal user privilege to obta↗2022-03-08
▶