CVE-2025-14592

Published Feb 11, 2026

Last updated 24 days ago

CVSS low 3.7

graphql

Overview

Description: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user to perform unauthorized operations by submitting GraphQL mutations through the GLQL API endpoint.
Source: cve@gitlab.com
NVD status: Analyzed
Products: gitlab

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.3
Impact score: 1.4
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Severity: MEDIUM

Weaknesses

cve@gitlab.com: CWE-862

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "matchCriteriaId": "C3F7C278-FF2A-49DE-AE73-6B94C9833230",
            "versionEndExcluding": "18.6.6",
            "versionStartIncluding": "18.6.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "22C1B676-A5D2-40E7-8399-CFB9BCEEDE92",
            "versionEndExcluding": "18.6.6",
            "versionStartIncluding": "18.6.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "matchCriteriaId": "EB4484C1-2D91-48A6-B396-4F16DC598828",
            "versionEndExcluding": "18.7.4",
            "versionStartIncluding": "18.7.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "DA7B13F4-05B9-436E-A1DC-6C65DB7B44FE",
            "versionEndExcluding": "18.7.4",
            "versionStartIncluding": "18.7.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "matchCriteriaId": "BCEB62DB-0D85-4A21-99C4-6235CA97A795",
            "versionEndExcluding": "18.8.4",
            "versionStartIncluding": "18.8.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "6D01D64A-0619-427D-B351-4101FC257674",
            "versionEndExcluding": "18.8.4",
            "versionStartIncluding": "18.8.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

Related CVEs

References