CVE-2025-2938: Elevation of Privilege impacts GitLab CE/EE
An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users to gain elevated project privileges by requesting access to projects where role modifications during the approval process resulted in unintended permission grants.
Other sources
GitLab has remediated an issue that could have allowed authenticated users to gain elevated project privileges by requesting access to projects where role modifications during the approval process resulted in unintended permission grants.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-2938?
CVE-2025-2938 is considered a medium severity vulnerability that allows authenticated users to gain elevated project privileges.
Who is affected by CVE-2025-2938?
CVE-2025-2938 affects all versions of GitLab CE/EE from 17.3 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1.
How do I fix CVE-2025-2938?
To fix CVE-2025-2938, upgrade GitLab CE/EE to version 17.11.5, 18.0.3, or 18.1.1.
Can CVE-2025-2938 be exploited without authentication?
No, CVE-2025-2938 requires authentication to exploit the elevated privileges vulnerability.
What type of access does CVE-2025-2938 provide to attackers?
CVE-2025-2938 allows authenticated users to gain elevated project privileges by improperly requesting access to projects.