CVE-2025-7691
BaseFortify
Publication date: 2025-09-26
Last updated on: 2025-09-29
Assigner: GitLab Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gitlab | gitlab | From 16.6.0 (inc) to 18.2.7 (exc) |
| gitlab | gitlab | From 16.6.0 (inc) to 18.2.7 (exc) |
| gitlab | gitlab | From 18.3.0 (inc) to 18.3.3 (exc) |
| gitlab | gitlab | From 18.3.0 (inc) to 18.3.3 (exc) |
| gitlab | gitlab | 18.4.0 |
| gitlab | gitlab | 18.4.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-267 | A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a privilege escalation issue in GitLab EE versions from 16.6 prior to 18.2.7, 18.3 prior to 18.3.3, and 18.4 prior to 18.4.1. It allows a developer who has specific group management permissions to escalate their privileges beyond what they should have, gaining unauthorized access to additional system capabilities.
How can this vulnerability impact me? :
If exploited, this vulnerability could allow a developer with certain group management permissions to gain unauthorized elevated privileges, potentially leading to unauthorized access to sensitive system functions or data, which could compromise the security and integrity of the system.