Loading vulnerability…
Privilege Persistence After Admin Role Revocation in GitLab CE/EE
CVE-2025-2242 is an improper access control vulnerability in GitLab Community Edition and Enterprise Edition. It affects versions 17.4 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. The flaw allows a user who previously held instance administrator privileges, but was later downgraded to a regular user, to continue retaining elevated privileges over groups and projects. The issue is a privilege persistence condition in which authorization state is not fully revoked after an administrative role change, resulting in continued access beyond the user’s current assigned role.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a downgraded former instance administrator to continue exercising elevated privileges over groups and projects despite no longer being entitled to them. This can result in unauthorized administrative actions within affected scopes, including continued access to sensitive project or group resources and the ability to manage those resources contrary to intended authorization policy. The vulnerability undermines role revocation and can lead to unauthorized access and privilege retention.
If you can’t patch tonight, do this now.
If immediate patching is not possible, organizations should review and revalidate permissions for any accounts that were previously assigned instance administrator privileges and later downgraded, with particular attention to residual access to groups and projects. Limit use of long-lived administrative accounts, monitor authorization changes and post-change effective permissions, and audit group/project membership and privilege assignments for former administrators until the upgrade is completed. Information about a vendor-provided workaround beyond upgrading is currently not available.
Patch, then assume compromise.
Upgrade GitLab CE/EE to a fixed release. Patched versions are 17.8.6, 17.9.3, and 17.10.1. Self-managed installations running affected versions should be updated immediately to one of these releases or a later fixed version.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.