CVE-2025-11971

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-11971
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-11971.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-11971
Aliases
Downstream
Published
2025-10-27T00:05:34.305Z
Modified
2026-04-10T05:20:48.373931Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N CVSS Calculator
Summary
Incorrect Authorization in GitLab
Details

GitLab has remediated an issue in GitLab EE affecting all versions from 10.6 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker to trigger unauthorized pipeline executions by manipulating commits.

Database specific 
{
    "cna_assigner": "GitLab",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11971.json",
    "cwe_ids": [
        "CWE-863"
    ]
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
3d59f5643aa87ca1fc506bf1ad37262d8ca6b4d6
Fixed
673f6894ea758431b872b17fe9794f6bf0b3b22b
Database specific 
{
    "versions": [
        {
            "introduced": "10.6"
        },
        {
            "fixed": "18.3.5"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
9255f56b45844196bb7657a9f1fde6aa65a5d08d
Fixed
4912fab157d78c195127403650672db8551e59b2
Database specific 
{
    "versions": [
        {
            "introduced": "18.4"
        },
        {
            "fixed": "18.4.3"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
37cc4da7158316bb9b204cef9b056f16fff1df32
Fixed
a01b2eeb76dd5df7024658f09f5ff6b27c01548e
Database specific 
{
    "versions": [
        {
            "introduced": "18.5"
        },
        {
            "fixed": "18.5.1"
        }
    ]
}

Affected versions

v18.*
v18.4.0-ee
v18.5.0-ee

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-11971.json"