CVE-2025-5069: 
GitLab vulnerability analysis and mitigation

An issue has been discovered in GitLab CE/EE affecting all versions from 17.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could have allowed an authenticated user to gain unauthorized access to confidential issues by creating a project with an identical name to the victim's project (NVD, GitLab Release).

The vulnerability is classified as an Incorrect Ownership Assignment (CWE-708) issue. The CVSS v3.1 scores vary between sources, with NVD assigning a Base Score of 6.5 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) while GitLab Inc. rates it as 3.5 LOW (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) (NVD, GitLab Release).

The vulnerability could allow authenticated users to gain unauthorized access to confidential issues, potentially leading to sensitive information being transferred to incorrect projects (GitLab Release).

GitLab has released patches in versions 18.2.7, 18.3.3, and 18.4.1 to address this vulnerability. Users are strongly recommended to upgrade to these patched versions immediately. GitLab.com is already running the patched version, and GitLab Dedicated customers do not need to take action (GitLab Release).

The vulnerability was reported through GitLab's HackerOne bug bounty program by researcher foxribeye, indicating active community participation in GitLab's security ecosystem (GitLab Release).