CVE-2025-5315

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users with Guest role permissions to add child items to incident work items by sending crafted API requests that bypassed UI-enforced role restrictions.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Jun 26, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-531507.8Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.CVE-2025-531517.8Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2025-531527.8Use after free in Desktop Windows Manager allows an authorized attacker to execute code locally.CVE-2025-531535.7Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over CVE-2025-531547.8Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.CVE-2025-531557.8Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally.CVE-2025-531565.5Exposure of sensitive information to an unauthorized actor in Storage Port Driver allows an authorized attacker to disclose information loca CVE-2025-531677.5Authentication vulnerability in the distributed collaboration framework module Impact: Successful exploitation of this vulnerability may aff CVE-2025-531685.7Vulnerability of bypassing the process to start SA and use related functions on distributed cameras Impact: Successful exploitation of this CVE-2025-531697.6Vulnerability of bypassing the process to start SA and use related functions on distributed cameras Impact: Successful exploitation of this CVE-2025-53175.5An improper access restriction to a folder in Bitdefender Endpoint Security Tools for Mac (BEST) before 7.20.52.200087 allows local users wi CVE-2025-531705.5Null pointer dereference vulnerability in the application exit cause module Impact: Successful exploitation of this vulnerability may affect