CVE-2025-6601: GitLab EE Authentication Bypass Vulnerability

CVE-2025-6601 Overview

GitLab patched an authorization flaw in GitLab Enterprise Edition (EE) that allowed authenticated users to gain unauthorized project access through the access request approval workflow. The issue affects all versions from 18.4 before 18.4.3, and 18.5 before 18.5.1. Under specific conditions, an attacker with a valid account could bypass intended access controls and obtain project membership they were not authorized to receive. The vulnerability is tracked under [CWE-840] (Business Logic Errors) and resolved in GitLab 18.4.3 and 18.5.1.

Critical Impact
Authenticated users can obtain unauthorized project access, compromising repository integrity and exposing source code, pipelines, and project secrets to users outside the intended membership boundary.

Affected Products

GitLab Enterprise Edition 18.4 before 18.4.3
GitLab Enterprise Edition 18.5 before 18.5.1
GitLab Enterprise Edition 18.5.0

Discovery Timeline

2025-10-22 - GitLab releases patch versions 18.4.3 and 18.5.1
2025-10-27 - CVE-2025-6601 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6601

Vulnerability Analysis

The flaw resides in GitLab EE's access request approval workflow, the mechanism that lets users request membership to a project and allows maintainers to approve or deny those requests. The workflow failed to correctly enforce authorization under certain conditions, enabling an authenticated user to receive project access without legitimate approval from an authorized maintainer or owner.

Successful exploitation grants the attacker the project role granted by the flawed workflow. This exposes source code, CI/CD pipeline definitions, protected branches, merge requests, and any secrets or variables scoped to the project. The vulnerability requires authentication but no user interaction, making it practical for insiders or holders of compromised low-privilege accounts.

Root Cause

The root cause is a business logic error [CWE-840] in the access request approval code path. The workflow accepted a state transition that should have been rejected, treating a request as approved without validating that the acting principal held sufficient permissions or that the approval conditions were met. GitLab has not published a technical breakdown of the exact precondition in the public advisory.

Attack Vector

The attack is network-based and requires only low-privilege authenticated access to a GitLab EE instance. The attacker submits an access request to a target project and then triggers the specific workflow state that causes the authorization check to be bypassed. No social engineering or victim interaction is required.

No verified proof-of-concept is publicly available. Technical details are tracked in the restricted GitLab Issue #551267 and HackerOne Report #3209641.

Detection Methods for CVE-2025-6601

Indicators of Compromise

Project membership entries added without a corresponding approval event by a maintainer or owner in the audit log.
Access request state transitions in the audit stream that complete without a recorded approver identity.
Unexpected access_level changes on project members for users who recently submitted access requests.

Detection Strategies

Query the GitLab audit events API for member_created and access_request_approved events and correlate them to confirm every new membership has a legitimate approver.
Review Git repository clone and pull activity against project membership change timestamps to flag immediate data access following suspicious membership additions.
Baseline normal project join patterns per group and alert on anomalous bursts of self-service access acquisitions.

Monitoring Recommendations

Forward GitLab audit events and application logs to a centralized SIEM for retention and correlation across the window of exposure.
Enable alerting on membership additions to projects containing sensitive labels, protected branches, or CI/CD secrets.
Periodically reconcile project membership lists against approved access request records exported from GitLab.

How to Mitigate CVE-2025-6601

Immediate Actions Required

Upgrade GitLab EE to 18.4.3, 18.5.1, or later as published in the GitLab Patch Release Announcement.
Audit all project membership changes made on affected versions between the 18.4 release and the upgrade date.
Revoke any project memberships that cannot be tied to a legitimate approval record.
Rotate CI/CD variables, deploy tokens, and secrets scoped to projects that were exposed to unauthorized members.

Patch Information

GitLab resolved the vulnerability in Enterprise Edition versions 18.4.3 and 18.5.1, released on 2025-10-22. The fix is included in the standard patch release and does not require configuration changes. Self-managed administrators should follow the standard upgrade procedure for their installation method (Omnibus, Helm chart, Docker, or source).

Workarounds

No official workaround is published; upgrading is the required remediation path.
As an interim risk reduction, disable the project-level access request feature under project settings for sensitive repositories until the upgrade is applied.
Restrict account creation and limit which authenticated users can submit access requests through group-level permission policies.

bash

# Verify installed GitLab version and upgrade (Omnibus example)
sudo gitlab-rake gitlab:env:info | grep "GitLab information" -A 5

# Debian/Ubuntu upgrade
sudo apt-get update && sudo apt-get install gitlab-ee=18.5.1-ee.0

# RHEL/CentOS upgrade
sudo yum install gitlab-ee-18.5.1-ee.0

# Disable project access requests via API as an interim control
curl --request PUT --header "PRIVATE-TOKEN: <admin_token>" \
  "https://gitlab.example.com/api/v4/projects/<project_id>?request_access_enabled=false"