CVE-2025-1540

Incorrect Authorization in GitLab

State: Published
Severity: 3.1 Low
Published: Mar 6, 2025
Updated: Mar 6, 2025
Reserved: Feb 21, 2025

Description

An issue has been discovered in GitLab CE/EE for Self-Managed and Dedicated instances affecting all versions from 17.5 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2. It was possible for a user added as an External to read and clone internal projects under certain circumstances."

Scores

CVSS	Score	Vector	Source
3.1	3.1 Low	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N	GitLab

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
GitLabGitLab	17.5 to before 17.6.5Affected 17.7 to before 17.7.4Affected 17.8 to before 17.8.2Affected

References

GitLab Issue #512765issue-trackingpermissions-required
https://about.gitlab.com/releases/2025/02/12/patch-release-gitlab-17-8-2-released/#saml-authentication-misconfigures-external-user-attribute

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.