CVE-2025-2498

An improper access control in Gitlab EE affecting all versions from 12.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2 that under certain conditions could have allowed users to view assigned issues from restricted groups by bypassing IP restrictions.

CVSS v3.1

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CVSS v3.1

3.1 LOWCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.24% chance of exploitation in the next 30 days, 16th percentile

Published

2025-08-13

Proof-of-concept exploits (1)

• https://hackerone.com/reports/3037722

References

• CVE Record
• NVD entry

Related

• CVE-2025-24975
• CVE-2025-24980
• CVE-2025-24971
• CVE-2025-24981
• CVE-2025-24970
• CVE-2025-24983