CVE-2025-5846

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab EE affecting all versions from 16.10 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users to assign unrelated compliance frameworks to projects by sending crafted GraphQL mutations that bypassed framework-specific permission checks.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Jun 26, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-584604.2A missing permission check in Jenkins OpenTelemetry Plugin 3.1543.v8446b_92b_cd64 and earlier allows attackers with Overall/Read permission CVE-2025-584629.8OPEXUS FOIAXpress Public Access Link (PAL) before version 11.13.1.0 allows SQL injection via SearchPopularDocs.aspx. A remote, unauthenticatCVE-2025-584634.9A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains an administrator account, tCVE-2025-584647.5A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker, they can then exploit the vulnerability tCVE-2025-584655.4A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they canCVE-2025-584664.9A use of uninitialized variable vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gainsCVE-2025-584676.5A relative path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then CVE-2025-584688.8A cross-site request forgery (CSRF) vulnerability has been reported to affect Notification Center. The remote attackers can then exploit theCVE-2025-584698.8A cross-site request forgery (CSRF) vulnerability has been reported to affect QuLog Center. The remote attackers can then exploit the vulnerCVE-2025-58478.8A vulnerability has been found in Tenda AC9 15.03.02.13 and classified as critical. Affected by this vulnerability is the function formSetSaCVE-2025-584706.5A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit tCVE-2025-584714.9An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains