CVE-2025-2498

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-2498
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-2498.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-2498
Aliases
Downstream
Published
2025-08-13T17:27:10.511Z
Modified
2026-04-10T05:23:08.797896Z
Severity
  • 3.1 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Insufficient Granularity of Access Control in GitLab
Details

An improper access control in Gitlab EE affecting all versions from 12.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2 that under certain conditions could have allowed users to view assigned issues from restricted groups by bypassing IP restrictions.

Database specific 
{
    "cna_assigner": "GitLab",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/2xxx/CVE-2025-2498.json",
    "cwe_ids": [
        "CWE-1220"
    ]
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
3b13818e8330f68625d80d9bf5d8049c41fbe197
Fixed
85327bfea0841b1eda70dc49b76918681510f967
Database specific 
{
    "versions": [
        {
            "introduced": "12.0"
        },
        {
            "fixed": "18.0.6"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
e0f3b86408aa4e7f03b63ac9e7dba6de1df14e93
Fixed
693bb5e6ca55d16970747e6a3157ab801608b758
Database specific 
{
    "versions": [
        {
            "introduced": "18.1"
        },
        {
            "fixed": "18.1.4"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
64403a0daee4413eb45b939590f37c351b8e72bf
Fixed
bef324d0853760755341c3ea7ca9469e4d962377
Database specific 
{
    "versions": [
        {
            "introduced": "18.2"
        },
        {
            "fixed": "18.2.2"
        }
    ]
}

Affected versions

v18.*
v18.1.0-ee
v18.2.0-ee

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-2498.json"