---
id: CVE-2025-10871
title: Missing Authorization in GitLab
summary: >-
  An issue has been discovered in GitLab EE affecting all versions from 16.6
  before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1. Project Maintainers
  can exploit a vulnerability where they can assign custom roles to users with
  permis…
severity: low
cvss: 3.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-862
vendor: GitLab
product: GitLab
affected:
  - GitLab >= 16.6 < 18.2.7
  - GitLab >= 18.3 < 18.3.3
  - GitLab >= 18.4 < 18.4.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2025-09-27T03:55:26.598432Z'
published: '2025-09-26'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T00:13:58.087Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-10871'
references:
  - url: 'https://gitlab.com/gitlab-org/gitlab/-/issues/569482'
    label: 'GitLab Issue #569482'
tags:
  - cve.org
epss: 0.00377
epssPercentile: 0.31866
ingestedAt: '2026-11-05T20:33:06.649Z'
---

## Overview

An issue has been discovered in GitLab EE affecting all versions from 16.6 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1. Project Maintainers can exploit a vulnerability where they can assign custom roles to users with permissions exceeding their own, effectively granting themselves elevated privileges.

## Affected

- `GitLab >= 16.6 < 18.2.7`
- `GitLab >= 18.3 < 18.3.3`
- `GitLab >= 18.4 < 18.4.1`

## Remediation

Upgrade to version 18.2.7, 18.3.3 or 18.4.1 or above.