CVE-2025-5121 is a high severity (CVSS 8.5) missing authorization flaw in GitLab CE and EE. A missing check may have allowed compliance frameworks to be applied to projects outside the framework's group. It affects 17.11 before 17.11.4 and 18.0 before 18.0.2, so upgrade to 17.11.4 or 18.0.2 or later.
What's affected
GitLab Community Edition and Enterprise Edition, per the record:
- All 17.11 versions before 17.11.4. The fixed release is 17.11.4.
- All 18.0 versions before 18.0.2. The fixed release is 18.0.2.
Versions outside those two ranges are not named as affected in the record. If you run a version older than 17.11 or you are on 18.1 or later, confirm against GitLab's release posts rather than assuming. The references are a GitLab issue and a HackerOne report. I did not read the GitLab issue contents, so this post goes no further than the record text.
The record says a missing authorization check may have allowed the action. Compliance frameworks are the labels groups use to mark projects that must meet certain rules, so the flaw touches how those rules are assigned.
How to check if you're exposed
Find your GitLab version. In the web interface, open the Help page, which shows the version. On a self managed Linux package install, an administrator can run:
sudo gitlab-rake gitlab:env:info
Then compare the result with the ranges above. If you are on 17.11.0 to 17.11.3 or 18.0.0 to 18.0.1, you are affected. GitLab.com is run by GitLab, so the self managed ranges matter for your own instances.
You can also run the free in-browser dependency scan at gold.safeguard.sh/scan, which checks the packages your own projects use against the Gold directory. It will not find a commercial product installed on a server, so pair it with an inventory of what runs where. Pinned versions of GitLab in infrastructure files are worth a search too:
grep -rn "gitlab" docker-compose*.yml helm/ values*.yaml 2>/dev/null
What to do now
- Find every self managed GitLab instance, including those run by other teams.
- Upgrade 17.11 instances to 17.11.4 or later, and 18.0 instances to 18.0.2 or later. Follow GitLab's upgrade path guidance for your version.
- Review which compliance frameworks exist and which projects they are applied to. Look for applications you did not make.
- Review who holds roles that can manage compliance frameworks, and remove roles that are not needed.
- Check audit events around the period before the upgrade for compliance framework changes you cannot explain.
Why it matters
The record lists CWE-862 (Missing Authorization). Missing authorization means the code performs an action without checking that the caller is allowed to do it. The user is signed in, but nothing asks whether they may act on that group or project. It is a different failure from a login bypass, and it is common in features that connect two objects, such as a framework and a project.
The CVSS vector shows a changed scope and high impact ratings, with high attack complexity and a low privilege account needed. The score reflects what compliance settings can affect, such as required controls and pipeline behaviour, though the record does not describe the exact outcome. Compliance labels are evidence in audits, so an unexpected assignment is both a security and a governance problem.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild. Because the fix is a normal patch release, the action is routine: schedule the upgrade.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which GitLab versions fix CVE-2025-5121?
17.11.4 for the 17.11 line and 18.0.2 for the 18.0 line, per the record. Later releases should include the fix, but check GitLab's release notes.
Does an attacker need an account?
The CVSS vector lists a low privilege account as required, so a signed in user is expected. The attack complexity is rated high.
Sources
Last reviewed: 18 October 2026.
