CVE-2025-10871: GitLab Privilege Escalation Vulnerability

CVE-2025-10871 Overview

CVE-2025-10871 is a privilege escalation vulnerability in GitLab Enterprise Edition (EE). The flaw allows Project Maintainers to assign custom roles to users with permissions that exceed the Maintainer's own privileges. Attackers with Maintainer access can grant themselves elevated capabilities, breaking the authorization boundary expected for that role.

The vulnerability affects GitLab EE versions 16.6 through 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1. GitLab tracks the issue under CWE-862 (Missing Authorization).

Critical Impact
A Project Maintainer can escalate to permissions normally reserved for Owners or administrators by abusing custom role assignment, compromising confidentiality, integrity, and availability of affected projects.

Affected Products

GitLab Enterprise Edition 16.6 through 18.2.7
GitLab Enterprise Edition 18.3 before 18.3.3
GitLab Enterprise Edition 18.4 before 18.4.1

Discovery Timeline

2025-09-26 - CVE-2025-10871 published to NVD
2025-09-29 - Last updated in NVD database

Technical Details for CVE-2025-10871

Vulnerability Analysis

GitLab EE supports custom roles that grant fine-grained permissions to project members. The authorization model expects that a user assigning a custom role cannot grant capabilities exceeding their own. CVE-2025-10871 breaks this expectation. A Project Maintainer can attach a custom role containing higher-privileged abilities to any user, including themselves.

Once assigned, the elevated permissions take effect immediately. This enables actions such as modifying protected branches, accessing restricted repository data, or altering project settings that should be limited to Owners. The vulnerability requires authenticated access at the Maintainer level, but no user interaction from the victim is needed.

Root Cause

The root cause is missing authorization (CWE-862) in the custom role assignment workflow. GitLab's permission check does not validate that the assigning user holds every permission contained within the custom role being assigned. The server accepts the role assignment without enforcing a privilege-comparison gate, leaving an authorization bypass in the role management API.

Attack Vector

The attack is performed over the network against an authenticated session. An attacker with Project Maintainer privileges crafts a role assignment request through the GitLab UI or REST API. The request attaches a custom role that includes permissions beyond Maintainer scope. After processing, the targeted account, typically the attacker's own, gains the elevated capabilities encoded in that custom role.

No proof-of-concept exploit code is publicly available. Refer to the GitLab Issue Discussion for the vendor's technical record.

Detection Methods for CVE-2025-10871

Indicators of Compromise

Audit log entries showing custom role assignments performed by Maintainer accounts to themselves or peers.
Custom roles containing Owner-level permissions being attached to non-Owner members.
Sudden access to protected branches, CI/CD variables, or settings by accounts that previously lacked those permissions.

Detection Strategies

Query GitLab audit events for member_role_assigned and compare the assigner's effective permissions against the assigned role's permission set.
Alert on any role assignment where the resulting permission set is a strict superset of the assigner's permissions.
Correlate role assignment events with subsequent privileged actions, such as branch protection changes or repository exports.

Monitoring Recommendations

Ingest GitLab audit and application logs into a centralized SIEM or data lake for continuous review. The Singularity Data Lake supports real-time ingestion with OCSF normalization for this use case.
Track changes to custom role definitions and flag new roles that include high-impact abilities.
Review Maintainer membership across projects and reduce the role's footprint where Owner-level oversight is required.

How to Mitigate CVE-2025-10871

Immediate Actions Required

Upgrade GitLab EE to 18.4.1, 18.3.3, or 18.2.7 depending on the deployed branch.
Audit all custom role assignments made before the upgrade and revoke any that exceed the assigner's authority.
Restrict the Project Maintainer role to trusted users until the patch is applied.

Patch Information

GitLab has released fixed versions 18.4.1, 18.3.3, and 18.2.7. Self-managed GitLab EE administrators should apply the upgrade following GitLab's standard update procedure. GitLab.com SaaS tenants are patched by the vendor. Track remediation status through the GitLab Issue Discussion.

Workarounds

Disable the custom roles feature for affected groups until the patch is applied.
Reduce the number of accounts holding the Maintainer role to limit exposure.
Remove custom roles that contain Owner-equivalent permissions and rebuild them after patching.

bash

# Example: review recent custom role assignments via the GitLab API
curl --header "PRIVATE-TOKEN: $TOKEN" \
  "https://gitlab.example.com/api/v4/groups/<group_id>/audit_events?created_after=2025-09-01"