CVE-2025-5846: Missing Authorization in GitLab
An issue has been discovered in GitLab EE affecting all versions from 16.10 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users to assign unrelated compliance frameworks to projects by sending crafted GraphQL mutations that bypassed framework-specific permission checks.
Other sources
GitLab has remediated an issue that could have allowed authenticated users to assign unrelated compliance frameworks to projects by sending crafted GraphQL mutations that bypassed framework-specific permission checks.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-5846?
The severity of CVE-2025-5846 is considered to be high due to its ability to allow authenticated users to manipulate compliance frameworks.
How do I fix CVE-2025-5846?
To fix CVE-2025-5846, upgrade GitLab EE to version 17.11.5 or higher, or to version 18.0.3 or higher, or to version 18.1.1 or higher.
What versions of GitLab EE are affected by CVE-2025-5846?
CVE-2025-5846 affects GitLab EE versions from 16.10 prior to 17.11.5, from 18.0 prior to 18.0.3, and from 18.1 prior to 18.1.1.
Can CVE-2025-5846 be exploited by unauthenticated users?
No, exploitation of CVE-2025-5846 requires authentication, as it involves authenticated user permissions.
What types of attacks are possible with CVE-2025-5846?
CVE-2025-5846 allows attackers to assign unrelated compliance frameworks to projects through crafted GraphQL mutations.