CVE-2025-9486

Analyzed Analyzed - Analysis Complete

Incorrect Privilege Assignment in GitLab EE Due to Pending Membership

Publication date: 2026-08-12

Last updated on: 2026-08-19

Assigner: GitLab Inc.

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed a user with a pending membership to receive permissions granted by a custom role, due to incorrect privilege assignment that did not account for membership state.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-19

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2025-9486

EUVD

EUVD-2025-210720

Affected Vendors & Products

Vendor	Product	Version / Range
gitlab	gitlab	From 19.1.0 (inc) to 19.1.4 (exc)
gitlab	gitlab	From 19.2.0 (inc) to 19.2.2 (exc)
gitlab	gitlab	From 15.6.0 (inc) to 19.0.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-266	A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability in GitLab EE allows a user with a pending membership to receive permissions from a custom role due to incorrect privilege assignment that does not check membership state. It affects versions before 19.0.6, 19.1.4, and 19.2.2.

Detection Guidance

This vulnerability affects GitLab EE versions before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2. To detect it, check your GitLab version using commands like 'gitlab-rake gitlab:env:info' or 'cat /opt/gitlab/version-manifest.txt'. If your version is below the patched releases, the system is vulnerable.

Impact Analysis

An attacker with pending membership could gain unauthorized access or perform actions they should not be allowed to do, potentially leading to data exposure or misuse of permissions.

Compliance Impact

This vulnerability could potentially impact compliance with standards like GDPR and HIPAA by allowing unauthorized access to sensitive data through incorrect privilege assignment. If a user with pending membership gains unauthorized permissions, it may lead to improper data access or processing, violating regulatory requirements for access control and data protection.

Mitigation Strategies

Upgrade GitLab EE to a patched version (19.0.6, 19.1.4, or 19.2.2 or later) to address the incorrect privilege assignment issue.

Hi! I’m here to help you understand CVE-2025-9486. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70