GitLab patches high severity account takeover, missing auth issues

Source: BleepingComputer

Author: Sergiu Gatlan

URL: https://www.bleepingcomputer.com/news/security/gitlab-patches-high-severity-account-takeover-missing-auth-issues/

  1. ONE SENTENCE SUMMARY: GitLab urgently released patches for critical vulnerabilities allowing account takeover, malicious CI/CD job injections, and denial-of-service attacks.

  2. MAIN POINTS:

  3. GitLab issued security updates for Community and Enterprise editions 18.0.2, 17.11.4, and 17.10.8.

  4. CVE-2025-4278 vulnerability allows attackers to hijack accounts through HTML injection.

  5. CVE-2025-5121 flaw permits malicious CI/CD job injection into future project pipelines.

  6. CVE-2025-2254 addresses a cross-site scripting vulnerability affecting legitimate user sessions.

  7. CVE-2025-0673 fixes a denial-of-service issue involving infinite redirect loops and memory exhaustion.

  8. GitLab.com and Dedicated customers already have the security patches applied.

  9. GitLab strongly urges immediate upgrades for all self-managed installations.

  10. Attackers exploiting CVE-2025-5121 require authenticated access to GitLab Ultimate licensed instances.

  11. Recent breaches affected Europcar Mobility Group and Pearson through compromised GitLab repositories.

  12. GitLab platform serves over 30 million users, including half of Fortune 100 companies.

  13. TAKEAWAYS:

  14. Immediately upgrade self-managed GitLab instances to patched versions.

  15. Ensure strict authentication and access controls, especially for GitLab Ultimate environments.

  16. Recognize the high-value target GitLab represents due to sensitive information in repositories.

  17. Regularly monitor GitLab security advisories to respond swiftly to emerging threats.

  18. Automate patching processes to streamline security updates and reduce administrative overhead.