CVE-2025-14595: Missing Authorization in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that under certain conditions could have allowed an authenticated user with Planner role to view security category metadata and attributes in group security configuration due to improper access control
Other sources
GitLab has remediated an issue that under certain conditions could have allowed an authenticated user with Planner role to view security category metadata and attributes in group security configuration due to improper access control.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-14595?
CVE-2025-14595 is classified as a high severity access control vulnerability.
How do I fix CVE-2025-14595?
To remediate CVE-2025-14595, upgrade GitLab EE to version 18.10.1 or later.
Who is affected by CVE-2025-14595?
CVE-2025-14595 affects users of GitLab EE versions between 18.6 and 18.10.0, specifically those with Planner role.
What types of issues does CVE-2025-14595 address?
CVE-2025-14595 addresses improper access control that may expose security category metadata to unauthorized users.
When was CVE-2025-14595 disclosed?
CVE-2025-14595 was disclosed in March 2026 as part of GitLab's release updates.