CVE-2025-9486: GitLab EE Privilege Escalation Vulnerability

CVE-2025-9486 Overview

CVE-2025-9486 is a privilege assignment flaw in GitLab Enterprise Edition (EE). The issue affects all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2. Under certain conditions, a user holding a pending membership could receive permissions granted by a custom role. The root cause is incorrect privilege assignment logic that does not account for membership state, mapped to [CWE-266] Incorrect Privilege Assignment. Exploitation requires high privileges and high attack complexity, limiting real-world impact to specific configurations where custom roles are assigned to users whose memberships have not been finalized.

Critical Impact
A user with a pending membership may inherit custom role permissions, granting limited unauthorized access to project or group resources in GitLab EE.

Affected Products

GitLab EE versions 15.6 through 19.0.5
GitLab EE versions 19.1 through 19.1.3
GitLab EE versions 19.2 through 19.2.1

Discovery Timeline

2026-08-12 - CVE-2025-9486 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2025-9486

Vulnerability Analysis

The vulnerability resides in GitLab EE's membership and role evaluation logic. GitLab allows administrators to define custom roles that bundle specific permissions for projects or groups. When a user is invited to a project or group, the membership record can exist in a pending state until the user accepts or the workflow completes. The flawed authorization path evaluates custom role permissions without validating whether the associated membership is active. As a result, users with pending memberships can obtain permissions intended only for accepted members. The confidentiality and integrity impact is limited, and the vulnerability does not affect availability.

Root Cause

The defect maps to [CWE-266] Incorrect Privilege Assignment. The permission resolver applies custom role grants based on the association between a user and a project or group without filtering by membership state. Pending records are treated equivalently to active memberships during privilege checks. This gap allows role-derived permissions to be enforced before the membership is confirmed.

Attack Vector

Exploitation requires an attacker with high privileges, such as an account able to trigger or hold a pending membership tied to a custom role on a target project or group. The attacker does not need user interaction. Once positioned, the account performs actions permitted by the custom role even though the underlying membership has not been accepted. The attack occurs over the network through standard GitLab interfaces such as the web UI, REST API, or GraphQL API.

No verified public proof-of-concept code is available. Technical detail is described in the GitLab Issue #565412 and the HackerOne Report #3262844.

Detection Methods for CVE-2025-9486

Indicators of Compromise

Audit log entries showing actions performed by users whose membership status is pending on the target project or group.
Custom role permission usage recorded against accounts that never accepted an invitation.
Unexpected access to resources shortly after invitation events without a corresponding acceptance event.

Detection Strategies

Correlate GitLab audit events for membership creation with subsequent authenticated actions, flagging cases where actions precede an acceptance event.
Query the members table or the Members API for entries with state = awaiting or requested that are linked to custom role IDs.
Review custom role assignment history and compare against the list of accepted memberships to identify divergences.

Monitoring Recommendations

Enable and forward GitLab audit events to a centralized log platform for retention and query.
Alert on API calls performed by accounts whose membership record on the acting namespace is not in an active state.
Monitor changes to custom role definitions and to invitations for privileged projects and groups.

How to Mitigate CVE-2025-9486

Immediate Actions Required

Upgrade GitLab EE to version 19.0.6, 19.1.4, 19.2.2, or later, matching the deployment branch.
Inventory all custom roles and identify which projects and groups have pending memberships attached.
Revoke and reissue invitations tied to sensitive custom roles after patching, and audit recent activity for those accounts.

Patch Information

GitLab released fixes in versions 19.0.6, 19.1.4, and 19.2.2. Details are documented in the GitLab Patch Release 19.2.2 announcement. Self-managed operators should apply the patch corresponding to their current release branch. GitLab.com is maintained by GitLab and does not require customer action.

Workarounds

Restrict the assignment of custom roles to only active, accepted members until the upgrade is applied.
Temporarily disable or reduce the permissions of high-impact custom roles on sensitive projects and groups.
Review and revoke pending invitations that are no longer required.

bash

# Verify the running GitLab version before and after patching
sudo gitlab-rake gitlab:env:info | grep -i "GitLab information" -A 5

# List pending or awaiting memberships via the Rails console for review
sudo gitlab-rails runner "Member.where(state: :awaiting).find_each { |m| puts [m.id, m.source_type, m.source_id, m.user_id, m.access_level].join(',') }"