CVE-2025-7691

MEDIUM

GitLab EE <18.2.7-<18.3.3-<18.4.1 - Privilege Escalation

Title source: llm

Description

A privilege escalation issue has been discovered in GitLab EE affecting all versions from 16.6 prior to 18.2.7, 18.3 prior to 18.3.3, and 18.4 prior to 18.4.1 that could have allowed a developer with specific group management permissions to escalate their privileges and obtain unauthorized access to additional system capabilities.

References (2)

[Broken Link] https://gitlab.com/gitlab-org/gitlab/-/issues/555786

[Permissions Required] https://hackerone.com/reports/3200469

Scores

CVSS v3 6.5

EPSS 0.0001

EPSS Percentile 0.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-267

Status published

Products (2)

gitlab/gitlab 18.4.0 (2 CPE variants)

gitlab/gitlab 16.6.0 - 18.2.7 (2 CPE variants)

Published Sep 26, 2025

Tracked Since Feb 18, 2026