CVE-2025-4972
BaseFortify
Publication date: 2025-07-10
Last updated on: 2025-07-25
Assigner: GitLab Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gitlab | gitlab | From 18.0.0 (inc) to 18.0.4 (exc) |
| gitlab | gitlab | From 18.1.0 (inc) to 18.1.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in GitLab EE allows authenticated users who have invitation privileges to bypass group-level user invitation restrictions by manipulating the group invitation functionality. It affects versions from 18.0 before 18.0.4 and 18.1 before 18.1.2.
How can this vulnerability impact me? :
The vulnerability could allow users with invitation privileges to invite users to groups despite restrictions, potentially leading to unauthorized access or membership in groups where they should not have been able to add users. This could impact the integrity of group membership controls.