CVE-2025-14562

LOW

Incorrect Authorization in GitLab

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-14562 has a selected CVSS score of 3.1 (low).

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to commit changes to a project after being removed as a member, due to improper authorization checks on merge request collaboration settings.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 29, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

GitLab

Browse GitLab / GitLab

Default status: unaffected

CVE List10.6 to < 19.0.5affected
19.1 to < 19.1.3affected
19.2 to < 19.2.1affected

References

4