CVE-2025-6601: Business Logic Errors in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.3, and 18.5 before 18.5.1 that under certain conditions could have allowed authenticated users to gain unauthorized project access by exploiting the access request approval workflow.
Other sources
GitLab has remediated an issue that under certain conditions could have allowed authenticated users to gain unauthorized project access by exploiting the access request approval workflow.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-6601?
The severity of CVE-2025-6601 is considered to be high due to the potential for unauthorized project access by authenticated users.
How do I fix CVE-2025-6601?
To fix CVE-2025-6601, update your GitLab EE installation to version 18.5.1 or later.
What versions of GitLab EE are affected by CVE-2025-6601?
The affected versions of GitLab EE include 18.3.5, 18.4.3, and all versions from 18.4 to 18.5.1.
What type of vulnerability is CVE-2025-6601?
CVE-2025-6601 is an access control vulnerability related to the project access request approval workflow.
Who can exploit CVE-2025-6601?
Authenticated users who have access to the GitLab environment may exploit CVE-2025-6601 under specific conditions.