CVE-2025-2938

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-2938
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-2938.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-2938
Aliases
Downstream
Published
2025-06-26T05:31:30.851Z
Modified
2026-04-10T05:24:29.944062Z
Severity
  • 3.1 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
Business Logic Errors in GitLab
Details

An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users to gain elevated project privileges by requesting access to projects where role modifications during the approval process resulted in unintended permission grants.

Database specific 
{
    "cna_assigner": "GitLab",
    "cwe_ids": [
        "CWE-840"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/2xxx/CVE-2025-2938.json"
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
5aad128b1defa01641e69fdcd5a2ec16bd1d4c2c
Fixed
946e44702b94b9e7ffd1e2b0562c307690b34249
Database specific 
{
    "versions": [
        {
            "introduced": "17.3"
        },
        {
            "fixed": "17.11.5"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
504fd9e5236e13d674e051c6b8a1e9892b371c58
Fixed
45c1990395788115261e2630bed64b3fb08738e2
Database specific 
{
    "versions": [
        {
            "introduced": "18.0"
        },
        {
            "fixed": "18.0.3"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
e0f3b86408aa4e7f03b63ac9e7dba6de1df14e93
Fixed
ceb07b24cb07cc00589bcd8974d9b4f30e3319a7
Database specific 
{
    "versions": [
        {
            "introduced": "18.1"
        },
        {
            "fixed": "18.1.1"
        }
    ]
}

Affected versions

v18.*
v18.0.0-ee
v18.1.0-ee

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-2938.json"