CVE-2025-5846

An issue has been discovered in GitLab EE affecting all versions from 16.10 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users to assign unrelated compliance frameworks to projects by sending crafted GraphQL mutations that bypassed framework-specific permission checks.

CVSS v3 2.7 LOW

2.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://gitlab.com/gitlab-org/gitlab/-/issues/546435	Broken Link

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:18.1.0::::enterprise:::

History

12 Aug 2025, 14:44

Type	Values Removed	Values Added
CPE		cpe:2.3:a:gitlab:gitlab:::::enterprise:::* cpe:2.3:a:gitlab:gitlab:18.1.0::::enterprise:::
References	~~() https://gitlab.com/gitlab-org/gitlab/-/issues/546435 -~~	() https://gitlab.com/gitlab-org/gitlab/-/issues/546435 - Broken Link
First Time		Gitlab gitlab Gitlab

26 Jun 2025, 18:57

Type	Values Removed	Values Added
Summary		(es) Se ha descubierto un problema en GitLab EE que afecta a todas las versiones desde la 16.10 hasta la 17.11.5, la 18.0 hasta la 18.0.3 y la 18.1 hasta la 18.1.1 que podría haber permitido a los usuarios autenticados asignar frameworks de cumplimiento no relacionados a los proyectos mediante el envío de mutaciones GraphQL manipuladas que eludían los controles de permisos específicos del framework.

26 Jun 2025, 06:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-06-26 06:15

Updated : 2025-08-12 14:44

NVD link : CVE-2025-5846

Mitre link : CVE-2025-5846

CVE.ORG link : CVE-2025-5846

JSON object : View

Products Affected

gitlab

gitlab

CWE

CWE-862

Missing Authorization

{"id": "CVE-2025-5846", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@gitlab.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2025-06-26T06:15:24.030", "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/546435", "tags": ["Broken Link"], "source": "cve@gitlab.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "cve@gitlab.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "An issue has been discovered in GitLab EE affecting all versions from 16.10 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users to assign unrelated compliance frameworks to projects by sending crafted GraphQL mutations that bypassed framework-specific permission checks."}, {"lang": "es", "value": "Se ha descubierto un problema en GitLab EE que afecta a todas las versiones desde la 16.10 hasta la 17.11.5, la 18.0 hasta la 18.0.3 y la 18.1 hasta la 18.1.1 que podr\u00eda haber permitido a los usuarios autenticados asignar frameworks de cumplimiento no relacionados a los proyectos mediante el env\u00edo de mutaciones GraphQL manipuladas que elud\u00edan los controles de permisos espec\u00edficos del framework."}], "lastModified": "2025-08-12T14:44:01.437", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "07AEA00E-F0F2-4E5A-97A5-9AD0ECB732F0", "versionEndExcluding": "17.11.5", "versionStartIncluding": "16.10.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "912DFFB2-0D98-4506-AEB6-2AC3C2330554", "versionEndExcluding": "18.0.3", "versionStartIncluding": "18.0.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:18.1.0:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "1FA1F1D0-87EA-44A6-AFB7-267BB21A7412"}], "operator": "OR"}]}], "sourceIdentifier": "cve@gitlab.com"}