CVE-2025-9486 in GitLab
Summary
by MITRE • 08/12/2026
GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed a user with a pending membership to receive permissions granted by a custom role, due to incorrect privilege assignment that did not account for membership state.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/12/2026
This vulnerability represents a critical access control flaw in GitLab Enterprise Edition that could potentially allow unauthorized users to escalate their privileges through improper handling of membership states within custom role assignments. The issue specifically affected versions ranging from 15.6 up to 19.0.5, 19.1 up to 19.1.3, and 19.2 up to 19.2.1, creating a window of exposure where pending members could inherit permissions that should only be granted to confirmed participants in projects or groups.
The technical root cause stems from incorrect privilege assignment logic that failed to properly validate membership status when processing custom role grants. This flaw operates under the principle that pending memberships should not automatically confer access rights, yet the system was incorrectly permitting permission inheritance regardless of whether a user had completed their membership approval process. The vulnerability aligns with CWE-284 which addresses improper access control and specifically targets the weakness of inadequate privilege management in collaborative software environments.
Operationally this issue created significant security risks for organizations relying on GitLab's role-based access control system, as it allowed unauthorized individuals to potentially gain access to sensitive repositories, code modifications, or administrative functions before their membership was properly validated. The impact extends beyond simple permission escalation to include potential data exposure and integrity risks in environments where pending members might have access to confidential project information or development workflows.
The remediation implemented by GitLab addresses this through proper membership state validation during role assignment processes, ensuring that custom roles are only granted to confirmed members who have completed their membership approval workflow. Organizations should prioritize immediate patching of affected systems and conduct thorough audits of existing membership states and permission assignments to identify any potential unauthorized access that may have occurred during the vulnerable period. This vulnerability demonstrates the critical importance of proper access control validation in distributed development platforms and aligns with ATT&CK technique T1078 which covers valid accounts and privilege escalation through improper access controls.