CVE-2025-6601: 
GitLab vulnerability analysis and mitigation

GitLab has identified a business logic error vulnerability (CVE-2025-6601) affecting GitLab Enterprise Edition (EE). The vulnerability affects all versions from 18.4 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1. This security issue was discovered and reported through GitLab's HackerOne bug bounty program by researcher rhidayahh (GitLab Patch Release).

The vulnerability has been assigned a CVSS v3.1 score of 3.8 (Low severity) with the following vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N. The vulnerability is characterized by a business logic error in the group memberships functionality that specifically impacts the access request approval workflow (GitLab Patch Release).

Under certain conditions, authenticated users could potentially gain unauthorized project access by exploiting vulnerabilities in the access request approval workflow. The impact is limited to low-level confidentiality and integrity breaches, with no impact on system availability (GitLab Patch Release).

GitLab has released patches to address this vulnerability in versions 18.5.1, 18.4.3, and 18.3.5. Users are strongly recommended to upgrade to these patched versions immediately. GitLab.com is already running the patched version, and GitLab Dedicated customers do not need to take any action (GitLab Patch Release).