CVE-2025-5069 Incorrect Ownership Assignment in GitLab

Low 3.5 Published 26 Sep 2025 Updated 26 Sep 2025

Authenticated users can access confidential issues by creating a project with an identical name to the victim's project.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2025-5069?

CVE-2025-5069 is a low-severity missing authorization vulnerability in Gitlab Gitlab, published on 26 Sep 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

An issue has been discovered in GitLab CE/EE affecting all versions from 17.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could have allowed an authenticated user to gain unauthorized access to confidential issues by creating a project with an identical name to the victim's project.

Weakness: CWE-708

Which versions are affected by CVE-2025-5069?

1 open source package ship an affected version, including gitlab. It affects 1 product.

Package	Affected	Fixed in
`gitlab` Bitnami	From `17.10.0`	`18.2.7, 18.3.3, 18.4.1`

Products include Gitlab Gitlab.

How do I fix CVE-2025-5069?

Upgrade gitlab to a fixed version for your release line: 18.2.7, 18.3.3 or 18.4.1.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-5069 being exploited?

There is no known exploitation of CVE-2025-5069 in the wild and no public exploit code.

All Gitlab Gitlab vulnerabilities

Sources

Also known as BIT-gitlab-2025-5069, GHSA-q6mw-555r-hgcg.