GitLab EE CVE-2025-4972: How a Low-Severity Auth Bypass Could Undermine Group Security

Introduction

One missed authorization check can undo the access controls of even a mature DevOps platform. In July 2025, GitLab Enterprise Edition (EE) users learned this firsthand. A subtle flaw let certain users bypass group-level invitation restrictions, which could expose sensitive projects to unauthorized collaborators. CVE-2025-4972 has a low CVSS score, but for organizations that rely on strict group boundaries, the real-world implications are significant.

About GitLab: GitLab Inc. builds a DevOps platform that millions of developers and enterprises worldwide use for source code management and CI/CD. Its Enterprise Edition (EE) is especially common in regulated industries and large organizations that need granular access controls and strong auditability.

Technical information

Vulnerability mechanism

CVE-2025-4972 is an incorrect authorization flaw (CWE-863) in GitLab EE's group invitation subsystem. It affects all versions from 18.0 before 18.0.4 and 18.1 before 18.1.2.

• Who could exploit it? Authenticated users with group invitation privileges.
• What could they do? Bypass group-level user invitation restrictions by manipulating the invitation process.
• How? They could send crafted HTTP requests, either through the web UI (using browser dev tools) or directly to the API (for example, POST /api/v4/groups/:id/invitations), and invite users to groups where policy should have blocked the invitation.

Technical root cause

The vulnerable code was in the Groups::InvitationsController component. The controller did not enforce group-level invitation policies on incoming requests. When it processed an invitation, it did not recheck whether the inviting user's privileges matched the group's configured restrictions.

Patch diff example:

def create
  @group = Group.find(params[:id])
  authorize! :admin_group, @group  # Added strict authorization check

  # Existing invitation logic
  invite_result = Members::CreateService.new(current_user, params.merge(source: @group)).execute
  # ...
end

The patch, introduced in 18.0.4 and 18.1.2, lets only users with the proper administrative rights invite new members, so the group-level policies are now strictly enforced.

Attack vectors

• Web UI manipulation: Using browser tools to alter invitation form data and get past client-side checks.
• API abuse: Sending crafted requests to the group invitation endpoint with parameters that circumvent the intended restrictions.

Exploitation requirements

• The attacker must be an authenticated user with invitation privileges.
• No user interaction is required beyond the crafted request.
• The attack is remote and works over standard HTTP/S.

Patch information

Immediate remediation: Upgrade GitLab EE to one of the following versions:

• 18.0.4 or later (for 18.0.x installations)
• 18.1.2 or later (for 18.1.x installations)

"Improper Authorization in Group Invitations (CVE-2025-4972): Users with invitation privileges could bypass group-level user invitation restrictions through crafted API requests. Fix: Revised the group invitation functionality to include strict authorization checks, preventing unauthorized user invitations."

See the official patch advisory: GitLab 18.1.2 Patch Release

Detection methods

• Automated scanning: Use Tenable Nessus plugin ID 241692 to detect vulnerable GitLab EE installations. The plugin checks the self-reported version number to determine exposure.
• Manual review: Audit GitLab logs for unauthorized or unusual group invitation activity, especially for the period when a vulnerable version was running.

Reference: Tenable Nessus Plugin 241692

Affected systems and versions

• Product: GitLab Enterprise Edition (EE)
• Affected versions:
  • 18.0.0 up to (but not including) 18.0.4
  • 18.1.0 up to (but not including) 18.1.2
• Configuration: Only installations where users have been delegated group invitation privileges are at risk. Community Edition (CE) is not affected.

Vendor security history

GitLab's security program includes a public bug bounty and regular patch releases. Earlier advisories have reported other authorization issues, especially in group and project management. GitLab typically patches these flaws within weeks, a track record that points to a mature and responsive security process.

References

• NVD Entry for CVE-2025-4972
• GitLab 18.1.2 Patch Release Advisory
• Tenable Nessus Plugin 241692
• HackerOne Report #3148693

Source: This report was created using AI

If you have suggestions for improvement or feedback, please email us at [email protected]