CVE-2025-14562: GitLab Authorization Bypass Vulnerability

CVE-2025-14562 Overview

CVE-2025-14562 is an improper authorization vulnerability [CWE-863] in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw affects all versions from 10.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1. Under certain conditions, an authenticated user holding developer-role permissions can commit changes to a project after being removed as a member. The issue stems from missing authorization checks on merge request collaboration settings, which continue to grant push access after membership revocation.

Critical Impact
Former project developers retain write access to source repositories, breaking access revocation guarantees and enabling unauthorized code changes.

Affected Products

GitLab CE/EE versions 10.6 through 19.0.4
GitLab CE/EE versions 19.1.0 through 19.1.2
GitLab CE/EE versions 19.2.0

Discovery Timeline

2026-07-29 - CVE-2025-14562 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-14562

Vulnerability Analysis

The vulnerability resides in GitLab's merge request collaboration feature. When a fork owner opens a merge request against an upstream project, GitLab offers a setting that allows upstream project maintainers to push commits to the source branch of the merge request. This delegated write access is intended to speed up review cycles.

The authorization check for this collaboration path does not properly re-evaluate membership status. When a user with developer-role permissions is later removed from the project, GitLab continues to honor the previously granted collaboration permission. The former member can push commits to the fork's source branch through the merge request context.

According to the assigned CWE, the underlying weakness is incorrect authorization [CWE-863] rather than missing authorization. The relevant code paths perform checks, but the checks do not correctly reflect the current membership state.

Root Cause

The root cause is stale permission evaluation on the allow_collaboration (also referred to as allow_maintainer_to_push) flag of a merge request. GitLab keys authorization on the merge request record and the original member relationship, not on a live check of current project membership.

Attack Vector

Exploitation requires an authenticated user who previously held developer-role permissions on the target project and had an open merge request with collaboration enabled. After the user is removed from the project, they can still push commits to the merge request source branch. The attack complexity is high because it depends on pre-existing merge requests and collaboration configuration. No user interaction is required from another party.

Refer to the GitLab Patch Release Note, GitLab Work Item #583889, and HackerOne Report #3460445 for technical details.

Detection Methods for CVE-2025-14562

Indicators of Compromise

Push events in project audit logs authored by user accounts that are no longer members of the project.
Commits appearing on merge request source branches after the associated author was removed from the project membership list.
Merge requests with allow_collaboration set to true where the source project author has been offboarded.

Detection Strategies

Query GitLab audit events for push and commit actions and cross-reference commit authors against current project_members records.
Review the GitLab API endpoint /projects/:id/merge_requests?wip=no and inspect the allow_collaboration field alongside member changes.
Correlate member_removed audit events with subsequent Git push activity by the same user within the same project.

Monitoring Recommendations

Enable GitLab audit event streaming and forward Git activity logs to a centralized log store for correlation with identity events.
Alert on any commit whose author or committer email is not present in the current project or group membership.
Track the EPSS score for CVE-2025-14562 (currently 0.225%, percentile 13.26) and reassess prioritization if it rises.

How to Mitigate CVE-2025-14562

Immediate Actions Required

Upgrade GitLab CE/EE to 19.0.5, 19.1.3, 19.2.1, or later depending on your deployment track.
Audit all open merge requests with the allow_collaboration flag enabled and close or reset those linked to offboarded users.
Rotate any credentials, deploy keys, or CI/CD secrets that may have been exposed to former developers who retained push access.

Patch Information

GitLab addressed the flaw in versions 19.0.5, 19.1.3, and 19.2.1. Details are published in the GitLab Patch Release Note and tracked in GitLab Work Item #583889. Self-managed operators should apply the patch during the next maintenance window; GitLab.com is patched by the vendor.

Workarounds

Disable merge request collaboration by unchecking "Allow commits from members who can merge to the target branch" on open merge requests.
Enforce a project offboarding process that closes or reassigns any open merge requests owned by the departing user.
Restrict developer-role grants to trusted contributors and prefer time-bound project memberships where feasible.

bash

# List merge requests with collaboration enabled via the GitLab API
curl --header "PRIVATE-TOKEN: $GITLAB_TOKEN" \
  "https://gitlab.example.com/api/v4/projects/$PROJECT_ID/merge_requests?state=opened" \
  | jq '.[] | select(.allow_collaboration==true) | {iid, author: .author.username, title}'