CVE-2025-14595: GitLab Auth Bypass Vulnerability

CVE-2025-14595 Overview

CVE-2025-14595 is an improper access control vulnerability affecting GitLab Enterprise Edition (EE) that could allow an authenticated user with the Planner role to view security category metadata and attributes in group security configuration. This vulnerability exists in GitLab EE versions 18.6 through 18.8.6, 18.9 through 18.9.2, and version 18.10.0.

The vulnerability stems from insufficient authorization checks in the group security configuration endpoints, enabling users with limited Planner privileges to access security-related information they should not be able to view. While this is classified as an information disclosure issue with medium severity, it could potentially expose sensitive security configurations to unauthorized personnel within an organization.

Critical Impact

Authenticated users with Planner role can access sensitive security category metadata and attributes in group security configuration due to broken access control.

Affected Products

• GitLab Enterprise Edition versions 18.6 before 18.8.7
• GitLab Enterprise Edition versions 18.9 before 18.9.3
• GitLab Enterprise Edition version 18.10.0

Discovery Timeline

• 2026-03-25 - CVE-2025-14595 published to NVD
• 2026-03-25 - GitLab releases security patch versions 18.8.7, 18.9.3, and 18.10.1
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2025-14595

Vulnerability Analysis

This vulnerability is classified under CWE-862 (Missing Authorization), indicating that the application fails to perform proper authorization checks before granting access to protected resources. In this case, GitLab EE does not adequately verify that users requesting access to group security configuration data possess the appropriate permissions beyond the Planner role.

The vulnerability allows network-based exploitation by authenticated users without requiring user interaction. The attack complexity is low, meaning no special conditions or circumstances need to exist for exploitation. The impact is limited to confidentiality, allowing unauthorized read access to security metadata and attributes, but does not affect data integrity or system availability.

Root Cause

The root cause is improper access control implementation in GitLab EE's group security configuration module. The application fails to enforce proper role-based access restrictions, allowing users with the Planner role to access security configuration data that should be restricted to users with elevated security permissions. This represents a broken access control pattern where the authorization boundary between different user roles is not properly enforced.

Attack Vector

The attack vector is network-based and requires authentication with at least Planner role privileges. An attacker who has obtained or been granted Planner access to a GitLab group can exploit this vulnerability to enumerate security category metadata and view attributes in the group's security configuration.

The exploitation flow involves:

1. Authenticating to GitLab EE with valid credentials that have Planner role assigned
2. Navigating to or making API requests to the group security configuration endpoints
3. Viewing security metadata and attributes that should be restricted to higher-privileged users

Additional technical details can be found in the HackerOne Report #3457779 and GitLab Work Item #583971.

Detection Methods for CVE-2025-14595

Indicators of Compromise

• Unusual access patterns to group security configuration endpoints by users with Planner role
• Unexpected API calls to security configuration resources from low-privileged accounts
• Audit log entries showing Planner-role users accessing security metadata they shouldn't have access to

Detection Strategies

• Review GitLab audit logs for access to group security configuration by users with Planner role
• Monitor API access patterns for security configuration endpoints and correlate with user permission levels
• Implement alerting on security configuration access by non-security personnel
• Conduct periodic access reviews to identify users with Planner role who may have accessed sensitive security data

Monitoring Recommendations

• Enable comprehensive audit logging for group security configuration access in GitLab
• Configure SIEM rules to detect anomalous access patterns to security-related endpoints
• Review user role assignments regularly to ensure principle of least privilege
• Monitor for reconnaissance activities targeting security configuration across multiple groups

How to Mitigate CVE-2025-14595

Immediate Actions Required

• Upgrade GitLab EE to patched versions immediately: 18.8.7, 18.9.3, or 18.10.1
• Audit access logs to determine if this vulnerability has been exploited in your environment
• Review and restrict Planner role assignments to only those users who require it
• Assess what security metadata may have been exposed and evaluate potential impact

Patch Information

GitLab has released patched versions that address this vulnerability. Organizations should upgrade to one of the following versions based on their current deployment:

• Version 18.8.7 for organizations on the 18.8.x branch
• Version 18.9.3 for organizations on the 18.9.x branch
• Version 18.10.1 for organizations on the 18.10.x branch

Detailed patch information is available in the GitLab Patch Release 18.10.1 announcement.

Workarounds

• Review and minimize the number of users with Planner role until patching is complete
• Implement network-level restrictions to limit access to GitLab administrative interfaces
• Enable enhanced audit logging to monitor for potential exploitation attempts
• Consider temporarily restricting access to security configuration features for non-administrative users

# Check current GitLab version
gitlab-rake gitlab:env:info

# For installations using the Omnibus package, upgrade using:
apt-get update && apt-get install gitlab-ee=18.10.1-ee.0

# Verify the upgrade was successful
gitlab-rake gitlab:check