CVE-2025-6168: Incorrect Authorization in GitLab
An issue has been discovered in GitLab EE affecting all versions from 18.0 before 18.0.4 and 18.1 before 18.1.2 that could have allowed authenticated maintainers to bypass group-level user invitation restrictions by sending crafted API requests.
Other sources
GitLab has remediated an issue that could have allowed authenticated maintainers to bypass group-level user invitation restrictions by sending crafted API requests.
— GitLab
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.0.4Fixed in 18.1.2 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 18.0.4 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 18.1.2
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-6168?
CVE-2025-6168 is classified as a medium severity vulnerability.
How do I fix CVE-2025-6168?
To fix CVE-2025-6168, upgrade GitLab EE to version 18.0.4 or 18.1.2 or later.
Who is affected by CVE-2025-6168?
CVE-2025-6168 affects all versions of GitLab EE from 18.0 before 18.0.4 and 18.1 before 18.1.2.
What type of vulnerability is CVE-2025-6168?
CVE-2025-6168 is a vulnerability that allows authenticated maintainers to bypass user invitation restrictions.
What can happen if CVE-2025-6168 is exploited?
Exploitation of CVE-2025-6168 may lead to unauthorized user access within a GitLab group.