CVE-2025-5069: 
GitLab vulnerability analysis and mitigation

A vulnerability (CVE-2025-5069) was discovered in GitLab CE/EE affecting all versions from 17.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1. The issue relates to incorrect ownership assignment via the Move Issue drop-down functionality (GitLab Release, NVD).

The vulnerability allows an authenticated user to gain unauthorized access to confidential issues by creating a project with an identical name to the victim's project. The vulnerability has been classified with a CVSS v3.1 Base Score of 3.5 (Low) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N. The weakness has been categorized as CWE-708 (Incorrect Ownership Assignment) (NVD).

The vulnerability could allow authenticated users to access confidential issues they should not have access to by exploiting the project naming mechanism. This could lead to unauthorized disclosure of sensitive information contained within confidential issues (GitLab Release).

GitLab has released patches in versions 18.2.7, 18.3.3, and 18.4.1 to address this vulnerability. It is strongly recommended that all affected installations be upgraded to one of these patched versions immediately. GitLab.com is already running the patched version (GitLab Release).