CVE-2025-14562
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
GitLab CE/EE has improper authorization checks on merge request collaboration settings, allowing an authenticated user with developer role to commit changes to a project after being removed as a member. Affected versions are 10.6 through 19.0.4, 19.1 through 19.1.2, and 19.2 through 19.2.0.
Risk Assessment
The risk is continued unauthorized changes to a project by a former member, potentially compromising code integrity and access control.
Recommendation
Immediately upgrade GitLab CE/EE to version 19.0.5, 19.1.3, or 19.2.1, depending on the release line in use.
Original NVD description (English source)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to commit changes to a project after being removed as a member, due to improper authorization checks on merge request collaboration settings.