BaseFortify

Publication date: 2025-10-29

Last updated on: 2025-11-03

Assigner: GitLab Inc.

Description

GitLab has remediated an issue in EE affecting all versions from 17.1 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker with specific permissions to hijack project runners from other projects.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-29

Last Modified

2025-11-03

Generated

2026-07-06

AI Q&A

2025-10-29

EPSS Evaluated

2026-07-05

NVD

CVE-2025-11702

Affected Vendors & Products

Vendor	Product	Version / Range
gitlab	gitlab	From 17.1.0 (inc) to 18.3.5 (exc)
gitlab	gitlab	From 18.4.0 (inc) to 18.4.3 (exc)
gitlab	gitlab	18.5.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in GitLab EE versions before certain fixed releases allowed an authenticated attacker with specific permissions to hijack project runners from other projects. Essentially, it means that someone with limited access could take control of runners assigned to different projects, potentially interfering with or manipulating those projects' CI/CD processes.

Impact Analysis

The impact of this vulnerability includes unauthorized control over project runners, which could lead to disruption or manipulation of continuous integration and deployment workflows. This could result in compromised build processes, exposure of sensitive data, or execution of malicious code within the affected projects.

Mitigation Strategies

Upgrade GitLab EE to a fixed version: 18.3.5 or later if using 18.3, 18.4.3 or later if using 18.4, or 18.5.1 or later if using 18.5. Ensure that only trusted authenticated users have permissions to manage project runners to reduce risk.

Hi! I’m here to help you understand CVE-2025-11702. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70