CVE-2025-3396
Unknown
Unknown - Not Provided
BaseFortify
Publication date: 2025-07-10
Last updated on: 2025-07-25
Assigner: GitLab Inc.
Description
Description
An issue has been discovered in GitLab EE affecting all versions from 13.3 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2 that could have allowed authenticated project owners to bypass group-level forking restrictions by manipulating API requests.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gitlab | gitlab | From 13.3.0 (inc) to 17.11.6 (exc) |
| gitlab | gitlab | From 18.0.0 (inc) to 18.0.4 (exc) |
| gitlab | gitlab | From 18.1.0 (inc) to 18.1.2 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in GitLab EE allows authenticated project owners to bypass group-level forking restrictions by manipulating API requests. It affects versions from 13.3 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2.
How can this vulnerability impact me? :
The vulnerability could allow project owners to fork projects despite group-level restrictions, potentially leading to unauthorized code duplication or distribution within an organization.
Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70