{"affected":[{"defaultStatus":"unaffected","product":"GitLab","source":"CNA: GitLab","vendor":"GitLab","versions":[{"lessThan":"18.2.7","status":"affected","version":"16.6","versionType":"semver"},{"lessThan":"18.3.3","status":"affected","version":"18.3","versionType":"semver"},{"lessThan":"18.4.1","status":"affected","version":"18.4","versionType":"semver"}]}],"cveId":"CVE-2025-10871","cwes":["CWE-862"],"description":"An issue has been discovered in GitLab EE affecting all versions from 16.6 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1. Project Maintainers can exploit a vulnerability where they can assign custom roles to users with permissions exceeding their own, effectively granting themselves elevated privileges.","epss":{"date":"2026-11-03","percentile":0.31754,"score":0.00377},"exploits":[],"kev":null,"metrics":[{"score":3.8,"severity":"low","source":"CNA: GitLab","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L","version":"3.1"}],"modifiedAt":1793751238087,"publishedAt":1758877461687,"references":[{"source":"CNA: GitLab","tags":["issue-tracking","permissions-required"],"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/569482"}],"remediation":[{"kind":"fix","source":"CNA: GitLab","text":"Upgrade to version 18.2.7, 18.3.3 or 18.4.1 or above."}],"revision":"0eb6fd8bd74261f17239c856b1a8dbb2920b79cbfa7e630046f5ac931beee088","sources":[{"modifiedAt":1793751238087,"name":"CNA: GitLab","retrievedAt":1793754625987,"url":"https://www.cve.org/CVERecord?id=CVE-2025-10871"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793747321598,"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-10871"}],"ssvc":{"assessedAt":1758945326598,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Missing Authorization in GitLab","updatedAt":1793754625987}