CVE-2025-4972

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-4972
An issue has been discovered in GitLab EE affecting all versions from 18.0 before 18.0.4 and 18.1 before 18.1.2 that could have allowed authenticated users with invitation privileges to bypass group-level user invitation restrictions by manipulating group invitation functionality.

2.7 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://gitlab.com/gitlab-org/gitlab/-/issues/543816 Broken Link
https://hackerone.com/reports/3148693 Permissions Required
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
History

25 Jul 2025, 16:40

Type Values Removed Values Added
References () https://gitlab.com/gitlab-org/gitlab/-/issues/543816 - () https://gitlab.com/gitlab-org/gitlab/-/issues/543816 - Broken Link
References () https://hackerone.com/reports/3148693 - () https://hackerone.com/reports/3148693 - Permissions Required
First Time Gitlab gitlab
Gitlab
CPE cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*

10 Jul 2025, 13:17

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-10 09:15

Updated : 2025-07-25 16:40

NVD link : CVE-2025-4972

Mitre link : CVE-2025-4972

CVE.ORG link : CVE-2025-4972

JSON object : View

Products Affected

gitlab

  • gitlab
CWE
CWE-863

Incorrect Authorization