CVE-2025-11340

—

CVSS 3.1

7.7 high

EPSS

<1%p31

Published

Oct 9, 2025 (Oct 9, 2025)

Modified

Jun 17, 2026

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 to 18.3.4, 18.4 to 18.4.2 that, under certain conditions, could have allowed authenticated users with read-only API tokens to perform unauthorized write operations on vulnerability records by exploiting incorrectly scoped GraphQL mutations.

Vendors: gitlab
Products: gitlab
Weakness: CWE-863
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.