CVE-2025-5121: Missing Authorization in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 17.11 before 17.11.4 and 18.0 before 18.0.2. A missing authorization check may have allowed compliance frameworks to be applied to projects outside the compliance framework's group.
Other sources
GitLab has remediated an issue that, under certain conditions, could have allowed a successful attacker with authenticated access to a GitLab instance with a GitLab Ultimate license applied (paid customer or trial) to inject a malicious CI/CD job into all future CI/CD pipelines of any project.Impacted versions GitLab Ultimate EE from 17.11 before 17.11.4 and 18.0 before 18.0.2. CVSS 8.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-5121?
CVE-2025-5121 is considered a high-severity vulnerability due to the potential for unauthorized compliance framework application.
How do I fix CVE-2025-5121?
To address CVE-2025-5121, upgrade GitLab CE/EE to at least version 17.11.4 or 18.0.2.
Which versions of GitLab are affected by CVE-2025-5121?
CVE-2025-5121 affects all versions of GitLab CE/EE prior to 17.11.4 and 18.0.2.
What is the cause of CVE-2025-5121?
CVE-2025-5121 is caused by a missing authorization check in GitLab that enables compliance frameworks to be wrongly applied.
Does CVE-2025-5121 affect GitLab CE and GitLab EE?
Yes, CVE-2025-5121 affects both GitLab Community Edition (CE) and Enterprise Edition (EE).