CVE-2025-14103
Unauthorized Pipeline Variable Modification in GitLab CE/EE
Publication date: 2026-02-25
Last updated on: 2026-02-27
Assigner: GitLab Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gitlab | gitlab | From 17.7.0 (inc) to 18.7.5 (exc) |
| gitlab | gitlab | From 18.8.0 (inc) to 18.8.5 (exc) |
| gitlab | gitlab | From 17.7.0 (inc) to 18.7.5 (exc) |
| gitlab | gitlab | From 18.8.0 (inc) to 18.8.5 (exc) |
| gitlab | gitlab | 18.9.0 |
| gitlab | gitlab | 18.9.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The CVE-2025-14103 vulnerability in GitLab CE/EE is an Access Control issue affecting the Continuous Integration (CI) job mutation functionality.
This flaw could have allowed an unauthorized user with Developer-role permissions to set pipeline variables for manually triggered jobs under certain conditions.
It affects all GitLab CE/EE versions from 17.7 up to but not including the patched versions 18.7.5, 18.8.5, and 18.9.1.
How can this vulnerability impact me? :
This vulnerability allows a user with Developer-role permissions to modify pipeline variables for manually triggered jobs, which could lead to unauthorized changes in the CI pipeline behavior.
The CVSS score of 4.3 indicates a low to medium severity with potential for limited integrity impact, meaning the attacker could alter data or processes but without affecting confidentiality or availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2025-14103 vulnerability in GitLab CE/EE, users are strongly advised to upgrade their GitLab instances to the patched versions.
- Upgrade to GitLab CE/EE version 18.7.5 or later if you are using any version from 17.7 before 18.7.5.
- Upgrade to GitLab CE/EE version 18.8.5 or later if you are using any version from 18.8 before 18.8.5.
- Upgrade to GitLab CE/EE version 18.9.1 or later if you are using any version from 18.9 before 18.9.1.