Dashboard / CVE-2025-2938

CVE-2025-2938

LOW
INFO Priority: 0.01 BB Relevance: 46/100
Published: 2025-06-26 Modified: 2026-11-03 First seen: 2026-11-03 Status: active

Attack Surface

Network No Interaction

CVSS Vector Breakdown

AV: Network
AC: High
PR: Low
UI: None
S: Unchanged
C: None
I: Low
A: None

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users to gain elevated project privileges by requesting access to projects where role modifications during the approval process resulted in unintended permission grants.

Weakness Classification (1)

Affected Software (3)

VendorProductVersion
GitLab GitLab 17.3 < 17.11.5
GitLab GitLab 18.0 < 18.0.3
GitLab GitLab 18.1 < 18.1.1

References & Advisories (2)

https://hackerone.com/reports/3063091
technical-description exploit permissions-required
https://gitlab.com/gitlab-org/gitlab/-/issues/529006
issue-tracking permissions-required

Bug Bounty Relevance

46 / 100
✓ Network accessible
✓ No user interaction

CVSS Score

3.1 / 10.0 v3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS — Exploitation Probability

0.32%
Raw Score 0.003180
Percentile 25.2%
Date 2026-11-14

EPSS Trend

2026-11-14
0.00318
2026-11-13
0.00318
2026-11-12
0.00318
2026-11-10
0.00318
2026-11-09
0.00318
2026-11-08
0.00318
2026-11-07
0.00318
2026-11-06
0.00318
2026-11-05
0.00318
2026-11-04
0.00318
2026-11-03
0.00318

Intelligence Sources

mitre ref →

External Links