CVE-2025-11246: Insufficient Granularity of Access Control in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user with specific permissions to remove all project runners from unrelated projects by manipulating GraphQL runner associations.
Other sources
GitLab has remediated an issue that could have allowed authenticated users with specific permissions to remove all project runners from unrelated projects by manipulating GraphQL runner associations.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-11246?
CVE-2025-11246 has a medium severity rating due to its potential impact on project runner management.
How do I fix CVE-2025-11246?
To remediate CVE-2025-11246, upgrade to GitLab versions 18.5.6, 18.6.4, or 18.7.2 or later.
What software versions are affected by CVE-2025-11246?
CVE-2025-11246 affects GitLab versions from 15.4 to 18.5.5, 18.6.0 to 18.6.3, and 18.7.0 to 18.7.1.
Who is vulnerable to CVE-2025-11246?
Authenticated users with specific permissions in GitLab are vulnerable to CVE-2025-11246.
What is the impact of CVE-2025-11246?
CVE-2025-11246 could allow users to manipulate GraphQL runner associations to remove project runners from unrelated projects.