CVE-2025-5315: Missing Authorization in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users with Guest role permissions to add child items to incident work items by sending crafted API requests that bypassed UI-enforced role restrictions.
Other sources
GitLab has remediated an issue that could have allowed authenticated users with Guest role permissions to add child items to incident work items by sending crafted API requests that bypassed UI-enforced role restrictions.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-5315?
CVE-2025-5315 has been identified as a moderate severity vulnerability affecting certain versions of GitLab CE/EE.
How do I fix CVE-2025-5315?
To remediate CVE-2025-5315, upgrade GitLab CE/EE to versions 17.11.5, 18.0.3, or 18.1.1 or later.
What types of accounts are affected by CVE-2025-5315?
CVE-2025-5315 affects authenticated users with Guest role permissions in GitLab CE/EE.
What functionality is being exploited in CVE-2025-5315?
CVE-2025-5315 could allow Guest role users to add child items to incident work items through crafted API requests.
Which GitLab CE/EE versions are impacted by CVE-2025-5315?
CVE-2025-5315 affects GitLab CE/EE versions from 17.2 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1.