CVE-2025-14103: Missing Authorization in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.7 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthorized user with Developer-role permissions to set pipeline variables for manually triggered jobs under certain conditions.
Other sources
GitLab has remediated an issue that could have allowed an unauthorized user with Developer-role permissions to set pipeline variables for manually triggered jobs under certain conditions.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-14103?
The severity of CVE-2025-14103 is critical due to the potential for unauthorized users to manipulate pipeline variables.
How do I fix CVE-2025-14103?
To remediate CVE-2025-14103, upgrade GitLab to version 18.7.5, 18.8.5, or 18.9.1.
Which versions of GitLab are vulnerable to CVE-2025-14103?
CVE-2025-14103 affects GitLab versions from 17.7 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1.
What type of issue is CVE-2025-14103?
CVE-2025-14103 is an access control issue that allows unauthorized modification of pipeline variables.
Who is affected by CVE-2025-14103?
All users of GitLab CE/EE versions from 17.7 through versions prior to 18.7.5, 18.8.5, and 18.9.1 may be affected.