CVE-2025-6601 — Time-of-check Time-of-use (TOCTOU) Race Condition in Gitlab

CWE-840CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition6 documents6 sources
Severity
6.5MEDIUMNVD
EPSS
0.0%
top 95.24%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
GitlabDebian GitlabGitlab EE+1 more
Timeline
PublishedOct 27

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.3, and 18.5 before 18.5.1 that under certain conditions could have allowed authenticated users to gain unauthorized project access by exploiting the access request approval workflow.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages6 packages

▶CVEListV5gitlab/gitlab18.4 — 18.4.3+1
▶NVDgitlab/gitlab18.4.0 — 18.4.3+1
▶debiandebian/gitlab
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
OSV
CVE-2025-6601: GitLab has remediated an issue in GitLab EE affecting all versions from 18↗2025-10-27
▶
GHSA
GHSA-28w7-9227-5wcm: GitLab has remediated an issue in GitLab EE affecting all versions from 18↗2025-10-27
▶

📋Vendor Advisories

3
GitLab
CVE-2025-6601: GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.3, and 18.5 before 18.5.1 that under certain conditions could↗2025-10-27
▶
Debian
CVE-2025-6601: gitlab - GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 bef...↗2025
▶
Microsoft
A race condition could lead to a cross-origin container obtaining permissions of the top-level origin. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunder↗2024-07-09
▶