CVE-2025-11989: GitLab Auth Bypass Vulnerability

CVE-2025-11989 Overview

CVE-2025-11989 is a missing authorization vulnerability [CWE-862] in GitLab Enterprise Edition (EE). The flaw allows an authenticated attacker to execute unauthorized quick actions by embedding malicious commands inside specific descriptions. GitLab patched the issue in versions 18.3.5, 18.4.3, and 18.5.1. The vulnerability affects all GitLab EE versions from 17.6.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1.

Critical Impact
An authenticated attacker can trigger privileged quick actions on issues, merge requests, or epics, altering project state and confidentiality without proper authorization checks.

Affected Products

GitLab Enterprise Edition 17.6.0 through 18.3.4
GitLab Enterprise Edition 18.4.0 through 18.4.2
GitLab Enterprise Edition 18.5.0

Discovery Timeline

2025-10-22 - GitLab releases patch versions 18.5.1, 18.4.3, and 18.3.5
2025-10-27 - CVE-2025-11989 published to NVD
2025-10-28 - Last updated in NVD database

Technical Details for CVE-2025-11989

Vulnerability Analysis

GitLab quick actions are text-based commands (such as /assign, /close, /label, or /approve) that users embed in issue, merge request, and comment descriptions to perform privileged operations. The platform normally evaluates these commands against the executing user's permissions.

In the affected GitLab EE releases, quick actions placed in specific description fields bypassed authorization checks. An attacker with a low-privilege authenticated account could embed commands in a crafted description and have them executed in a context that exceeded their granted role. The resulting actions impact confidentiality and integrity of project data.

Root Cause

The root cause is a missing authorization check [CWE-862] in the quick action parser for certain description fields. The handler processed embedded commands without re-validating that the requesting user had the role required to perform each action.

Attack Vector

Exploitation requires network access to a vulnerable GitLab EE instance and a valid authenticated user account. The attacker submits an issue, merge request, or comparable resource containing quick action syntax in the description. When the description is processed, the unauthorized commands execute server-side. No user interaction from a privileged victim is required.

No public proof-of-concept is available. See the GitLab Security Issue Discussion for restricted technical details.

Detection Methods for CVE-2025-11989

Indicators of Compromise

Unexpected quick action events (/assign, /close, /approve, /unlock, /award) attributed to users without the role required to perform them.
Issue, merge request, or epic description edits that contain quick action syntax submitted by low-privilege accounts.
Audit log entries showing state changes on resources where the actor lacked direct authorization.

Detection Strategies

Review GitLab audit_events for quick action invocations correlated with the author's project role to identify mismatches.
Hunt across description and note content for /-prefixed quick action commands submitted by Guest or Reporter accounts.
Compare timestamps of resource state changes against expected approval workflows to detect bypasses.

Monitoring Recommendations

Forward GitLab audit and application logs to a centralized SIEM and alert on quick action events performed by users below the required role threshold.
Monitor merge request approval and issue closure rates for sudden spikes from non-maintainer accounts.
Track creation of new issues and merge requests containing quick action syntax in descriptions to baseline normal usage.

How to Mitigate CVE-2025-11989

Immediate Actions Required

Upgrade GitLab EE to version 18.5.1, 18.4.3, or 18.3.5 as appropriate for your release train.
Audit recent issue, merge request, and epic activity for unauthorized state changes triggered by quick actions.
Review user role assignments and revoke unnecessary access on internet-facing GitLab instances.

Patch Information

GitLab addressed the issue in the October 22, 2025 patch release. Apply the fixes documented in the GitLab Patch Release Announcement. Self-managed instances should follow the standard GitLab upgrade procedure to reach a fixed version.

Workarounds

No official workaround is published. Upgrading to a patched version is the supported remediation path.
As a compensating control, restrict project membership and limit Guest or Reporter access to sensitive projects until patching is complete.
Enforce mandatory code review and approval policies that require maintainer involvement to limit the impact of unauthorized quick actions.

bash

# Example upgrade commands for self-managed GitLab (Omnibus) - adjust for your distribution
# Debian/Ubuntu
sudo apt-get update && sudo apt-get install gitlab-ee=18.5.1-ee.0

# RHEL/CentOS
sudo yum install gitlab-ee-18.5.1-ee.0

# Verify version after upgrade
sudo gitlab-rake gitlab:env:info | grep -i version