GitLab EE 18.4/18.5: Authenticated users get unauthorized project access via approval workflow
CVE-2025-6601 Published on October 27, 2025
GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.3, and 18.5 before 18.5.1 that under certain conditions could have allowed authenticated users to gain unauthorized project access by exploiting the access request approval workflow.
Vulnerability Analysis
CVE-2025-6601 can be exploited with network access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and no impact on availability.
Weakness Type
Business Logic Errors
Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.
Products Associated with CVE-2025-6601
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2025-6601 are published in GitLab:
Affected Versions
GitLab:- Version 18.4 and below 18.4.3 is affected.
- Version 18.5 and below 18.5.1 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.