CVE-2025-9486: Incorrect Privilege Assignment in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed a user with a pending membership to receive permissions granted by a custom role, due to incorrect privilege assignment that did not account for membership state.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.0.6 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.1.4 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.2.2
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9486?
CVE-2025-9486 has a severity rating of low, specifically 3.3.
How do I fix CVE-2025-9486?
To address CVE-2025-9486, update GitLab EE to version 19.0.6 or later, 19.1.4 or later, or 19.2.2 or later.
Which versions of GitLab are affected by CVE-2025-9486?
CVE-2025-9486 affects all GitLab EE versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2.
What type of vulnerability is CVE-2025-9486?
CVE-2025-9486 is categorized as an incorrect privilege assignment vulnerability.
Are there any known exploits for CVE-2025-9486?
As of now, there are no known public exploits for CVE-2025-9486.