CVE-2025-3396: 
GitLab vulnerability analysis and mitigation

An authorization bypass vulnerability (CVE-2025-3396) was discovered in GitLab Enterprise Edition (EE) affecting all versions from 13.3 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2. The vulnerability was disclosed on July 9, 2025, and allows authenticated project owners to bypass group-level forking restrictions through API request manipulation (GitLab Release, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. It is classified under CWE-863 (Incorrect Authorization). The issue specifically involves the ability to manipulate API requests to bypass implemented group-level forking restrictions (NVD).

When exploited, this vulnerability allows authenticated project owners to circumvent group-level forking restrictions, potentially leading to unauthorized access to project forking capabilities. The impact is primarily focused on confidentiality with a low severity rating, while maintaining no direct impact on integrity or availability (GitLab Release).

GitLab has released patches in versions 17.11.6, 18.0.4, and 18.1.2 to address this vulnerability. Organizations running affected versions are strongly recommended to upgrade to the patched versions immediately. GitLab.com has already been updated with the security fix. GitLab Dedicated customers do not need to take any action as their instances are automatically patched (GitLab Release).