Listen to this Post
How the CVE Works
CVE-2025-6168 is an access control vulnerability in GitLab EE versions 18.0 to 18.0.4 and 18.1 to 18.1.2. Authenticated maintainers can bypass group-level user invitation restrictions by sending specially crafted API requests. This allows unauthorized addition of users to restricted groups, violating intended permission policies. The flaw stems from improper validation of API parameters during user invitation processing, enabling privilege escalation within group management.
DailyCVE Form
Platform: GitLab EE
Version: 18.0 – 18.0.4, 18.1 – 18.1.2
Vulnerability: Invitation Bypass
Severity: Critical
Date: 07/10/2025
Prediction: Patch by 08/15/2025
What Undercode Say
Analytics:
curl -X GET "https://gitlab.example.com/api/v4/groups" -H "PRIVATE-TOKEN: <maintainer_token>"
requests.post("https://gitlab.example.com/api/v4/groups/1/members", headers={"PRIVATE-TOKEN": "<malicious_token>"}, data={"user_id": "123", "access_level": "40"})
How Exploit:
Craft malicious API requests to add users to restricted groups.
Protection from this CVE:
Upgrade to GitLab EE 18.0.4+ or 18.1.2+.
Impact:
Unauthorized group access, privilege escalation.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
