GitLab EE CVE-2025-4972: How a Low-Severity Auth Bypass Could Undermine Group Security

Introduction

A single overlooked authorization check can unravel the access controls of even the most mature DevOps platforms. In July 2025, GitLab Enterprise Edition (EE) users learned this firsthand when a subtle flaw allowed certain users to bypass group-level invitation restrictions, potentially exposing sensitive projects to unauthorized collaborators. While the CVSS score for CVE-2025-4972 is low, the real-world implications for organizations relying on strict group boundaries are significant.

About GitLab: GitLab Inc. is a cornerstone of the DevOps ecosystem, powering source code management and CI/CD for millions of developers and enterprises worldwide. Its Enterprise Edition (EE) is especially prevalent in regulated industries and large organizations that require granular access controls and robust auditability.

Technical Information

Vulnerability Mechanism

CVE-2025-4972 is rooted in an incorrect authorization (CWE-863) within GitLab EE’s group invitation subsystem. The flaw affects all versions from 18.0 before 18.0.4 and 18.1 before 18.1.2. Here’s what went wrong:

Who could exploit it? Authenticated users with group invitation privileges.
What could they do? Bypass group-level user invitation restrictions by manipulating the invitation process.
How? By crafting specific HTTP requests, either via the web UI (using browser dev tools) or directly via the API (e.g., POST /api/v4/groups/:id/invitations), they could invite users to groups where such actions should have been blocked by policy.

Technical Root Cause

The vulnerable code resided in the Groups::InvitationsController component. The controller failed to enforce group-level invitation policies when processing incoming requests. Specifically, it did not revalidate whether the inviting user’s privileges aligned with the group’s configured restrictions at the time the invitation was processed.

Patch Diff Example:

def create
  @group = Group.find(params[:id])
  authorize! :admin_group, @group  # Added strict authorization check

  # Existing invitation logic
  invite_result = Members::CreateService.new(current_user, params.merge(source: @group)).execute
  # ...
end

The patch (introduced in 18.0.4 and 18.1.2) ensures that only users with proper administrative rights can invite new members, strictly enforcing group-level policies.

Attack Vectors

Web UI manipulation: Using browser tools to alter invitation form data and bypass client-side checks.
API abuse: Sending crafted API requests to the group invitation endpoint with parameters that circumvent intended restrictions.

Exploitation Requirements

The attacker must be an authenticated user with invitation privileges.
No user interaction is required beyond the crafted request.
The attack is remote and can be executed over standard HTTP/S.

Patch Information

Immediate remediation: Upgrade GitLab EE to one of the following versions:

18.0.4 or later (for 18.0.x installations)
18.1.2 or later (for 18.1.x installations)

"Improper Authorization in Group Invitations (CVE-2025-4972): Users with invitation privileges could bypass group-level user invitation restrictions through crafted API requests. Fix: Revised the group invitation functionality to include strict authorization checks, preventing unauthorized user invitations."

See the official patch advisory: GitLab 18.1.2 Patch Release

Detection Methods

Automated scanning: Use Tenable Nessus plugin ID 241692 to detect vulnerable GitLab EE installations. This plugin checks the self-reported version number to determine exposure.
Manual review: Audit GitLab logs for unauthorized or anomalous group invitation activity, especially during the window when vulnerable versions were in use.

Reference: Tenable Nessus Plugin 241692

Affected Systems and Versions

Product: GitLab Enterprise Edition (EE)
Affected versions:
- 18.0.0 up to (but not including) 18.0.4
- 18.1.0 up to (but not including) 18.1.2
Configuration: Only installations where users have been delegated group invitation privileges are at risk. Community Edition (CE) is not affected.

Vendor Security History

GitLab has a robust security program, including a public bug bounty and regular patch releases. Authorization issues, especially in group and project management, have been reported in previous advisories. The vendor typically patches such flaws within weeks, reflecting a mature and responsive security posture.

References

Source: This report was created using AI

If you have suggestions for improvement or feedback, please reach out to us at [email protected]