CVE-2025-4972

LowCVSS 2.7/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab EE affecting all versions from 18.0 before 18.0.4 and 18.1 before 18.1.2 that could have allowed authenticated users with invitation privileges to bypass group-level user invitation restrictions by manipulating group invitation functionality.

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Jul 10, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-497217.8Heap-based buffer overflow in Windows Fast FAT Driver allows an unauthorized attacker to elevate privileges locally.CVE-2025-497225.7Uncontrolled resource consumption in Windows Print Spooler Components allows an authorized attacker to deny service over an adjacent networkCVE-2025-497238.8Missing authorization in Windows StateRepository API allows an authorized attacker to perform tampering locally.CVE-2025-497248.8Use after free in Windows Connected Devices Platform Service allows an unauthorized attacker to execute code over a network.CVE-2025-497257.8Use after free in Windows Notification allows an authorized attacker to elevate privileges locally.CVE-2025-497267.8Use after free in Windows Notification allows an authorized attacker to elevate privileges locally.CVE-2025-497277.0Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.CVE-2025-497284.0Cleartext storage of sensitive information in Microsoft PC Manager allows an unauthorized attacker to bypass a security feature locally.CVE-2025-497298.8Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a networCVE-2025-49739.8The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to authentication bypass in aCVE-2025-497307.8Time-of-check time-of-use (toctou) race condition in Microsoft Windows QoS scheduler allows an authorized attacker to elevate privileges locCVE-2025-497313.1Improper handling of insufficient permissions or privileges in Microsoft Teams allows an authorized attacker to elevate privileges over a ne
CVE-2025-4972: Low severity, CVSS 2.7 | Vulnix