CVE-2025-3396

An issue has been discovered in GitLab EE affecting all versions from 13.3 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2 that could have allowed authenticated project owners to bypass group-level forking restrictions by manipulating API requests.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://gitlab.com/gitlab-org/gitlab/-/issues/534636	Broken Link
https://hackerone.com/reports/3079956	Permissions Required

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*

History

25 Jul 2025, 16:40

Type	Values Removed	Values Added
References	~~() https://gitlab.com/gitlab-org/gitlab/-/issues/534636 -~~	() https://gitlab.com/gitlab-org/gitlab/-/issues/534636 - Broken Link
References	~~() https://hackerone.com/reports/3079956 -~~	() https://hackerone.com/reports/3079956 - Permissions Required
Summary		(es) Se ha descubierto un problema en GitLab EE que afecta a todas las versiones desde la 13.3 hasta la 17.11.6, la 18.0 hasta la 18.0.4 y la 18.1 hasta la 18.1.2 que podría haber permitido a los propietarios de proyectos autenticados eludir las restricciones de bifurcación a nivel de grupo manipulando las solicitudes de API.
CPE		cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
First Time		Gitlab gitlab Gitlab

10 Jul 2025, 09:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-07-10 09:15

Updated : 2025-07-25 16:40

NVD link : CVE-2025-3396

Mitre link : CVE-2025-3396

CVE.ORG link : CVE-2025-3396

JSON object : View

Products Affected

gitlab

gitlab

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2025-3396", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@gitlab.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2025-07-10T09:15:29.980", "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/534636", "tags": ["Broken Link"], "source": "cve@gitlab.com"}, {"url": "https://hackerone.com/reports/3079956", "tags": ["Permissions Required"], "source": "cve@gitlab.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "cve@gitlab.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "An issue has been discovered in GitLab EE affecting all versions from 13.3 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2 that could have allowed authenticated project owners to bypass group-level forking restrictions by manipulating API requests."}, {"lang": "es", "value": "Se ha descubierto un problema en GitLab EE que afecta a todas las versiones desde la 13.3 hasta la 17.11.6, la 18.0 hasta la 18.0.4 y la 18.1 hasta la 18.1.2 que podr\u00eda haber permitido a los propietarios de proyectos autenticados eludir las restricciones de bifurcaci\u00f3n a nivel de grupo manipulando las solicitudes de API."}], "lastModified": "2025-07-25T16:40:05.687", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "82BBA6B0-370A-4213-9916-753AAA1D155E", "versionEndExcluding": "17.11.6", "versionStartIncluding": "13.3.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "4F27FCAE-C2B3-489C-AEDB-BA19DD32DE7A", "versionEndExcluding": "18.0.4", "versionStartIncluding": "18.0.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "163718AE-806A-4D9C-ADA1-30FBFA87C317", "versionEndExcluding": "18.1.2", "versionStartIncluding": "18.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@gitlab.com"}