Home

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 17.6.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker to execute unauthorized quick actions by including malicious commands in specific descriptions.

PUBLISHED Reserved 2025-10-20 | Published 2025-10-26 | Updated 2025-10-28 | Assigner GitLab




LOW: 3.7CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

Problem types

CWE-862: Missing Authorization

Product status

Default status
unaffected

17.6.0 (semver) before 18.3.5
affected

18.4 (semver) before 18.4.3
affected

18.5 (semver) before 18.5.1
affected

Credits

This vulnerability has been discovered internally by GitLab team member Eva Kadlecová finder

References

about.gitlab.com/...22/patch-release-gitlab-18-5-1-released/

gitlab.com/gitlab-org/security/gitlab/-/issues/1426 (GitLab Issue #1426) issue-tracking permissions-required

cve.org (CVE-2025-11989)

nvd.nist.gov (CVE-2025-11989)

Download JSON