CVE-2025-9486 GitLab CVE debrief

Who should care

Defenders and administrators of GitLab EE instances, especially those with custom roles and pending memberships, should assess exposure and prioritize remediation to prevent unintended privilege escalation and potential security breaches. They should verify and remediate this vulnerability in their GitLab EE instances, review and update custom role assignments to ensure correct privilege levels, and track exceptions, retest remediated assets, and close the

Why it matters

Defenders should prioritize verifying and remediating this vulnerability in their GitLab EE instances, especially those with custom roles and pending memberships, to prevent unintended privilege escalation and potential security breaches.

• Verification of custom role assignments and pending memberships is necessary to prevent unintended privilege escalation.
• Remediation of vulnerable versions is required to prevent exploitation.
• Defenders should review and update custom role assignments to ensure correct privilege levels.

Technical summary

The vulnerability affects GitLab EE versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2. It allows users with pending memberships to receive permissions granted by custom roles due to incorrect privilege assignment. This issue is particularly concerning for defenders and administrators of GitLab EE instances, especially those with custom roles and pending memberships, as it could lead to unintended privilege escalation and potential security breaches. Defenders should prioritize verifying and remediating this vulnerability in their GitLab EE instances.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in their GitLab EE instances, especially those with custom roles and pending memberships.

Recommended defensive actions

• Verify GitLab EE version and check for custom roles with pending memberships
• Remediate vulnerable versions by upgrading to 19.0.6, 19.1.4, or 19.2.2
• Review and update custom role assignments to ensure correct privilege levels
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, its impact, and affected versions. GitLab has released patches for the issue. The vulnerability affects GitLab EE versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2. It allows users with pending memberships to receive permissions granted by custom roles due to incorrect privilege assignment. Defenders should verify and remediate this vulnerability in their GitLab EE instances, especially those with custom roles and The

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.