Introduction
In GitLab Enterprise Edition, CVE-2025-11340 let authenticated users holding read-only API tokens perform write operations on vulnerability records through the GraphQL API. Unauthorized changes to those records can disrupt security workflows and compliance reporting, which affects organizations that rely on GitLab for vulnerability management.
GitLab is a DevOps platform widely used by enterprises and open-source communities worldwide. It provides source code management, CI/CD, and integrated security features for millions of users. Enterprise Edition (EE) is the premium offering and adds advanced security and compliance tools.
Technical information
CVE-2025-11340 is classified as CWE-863 (Incorrect Authorization). The flaw is in the GitLab EE GraphQL API, in the mutation logic that handles vulnerability records. By design, API tokens with the read_api scope are limited to read-only operations, and tokens with the broader api scope can both read and write.
Some GraphQL mutations were scoped incorrectly, so users authenticated with read_api tokens could invoke write operations on vulnerability records. That bypassed the expected permission model and escalated a read-only token to write access. The flaw affects the integrity of vulnerability data, not its confidentiality or availability. The CVSS v3.1 vector is:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
The vector breaks down as follows:
- Network exploitable
- Low attack complexity
- Requires low-privilege authentication (read-only token)
- No user interaction needed
- Changed scope (affects resources outside the vulnerable component's security boundary)
- High integrity impact
- No confidentiality or availability impact
The root cause is insufficient permission checks on the GraphQL mutations that handle vulnerability management. No public code snippets or proof of concept are available. A GitLab engineer found the flaw internally. It was not discovered through exploitation in the wild.
Affected systems and versions
- Product: GitLab Enterprise Edition (EE) only
- Affected versions:
- 18.3 through 18.3.4
- 18.4 through 18.4.2
- Only configurations where the GraphQL API is exposed and read-only API tokens are used for vulnerability management operations are vulnerable.
- Community Edition (CE) is not affected.
Vendor security history
GitLab releases security updates regularly and runs a public bug bounty program. Recent advisories have addressed several authorization and GraphQL-related vulnerabilities, including:
- CVE-2025-10004 (GraphQL API denial of service)
- CVE-2025-9825 (GraphQL API missing authorization for CI/CD jobs)
- CVE-2025-11042, CVE-2025-10867 (GraphQL API denial of service)
GitLab typically ships patches promptly, with detailed advisories. Authorization logic in complex API features has been a recurring problem, but the company's response process is transparent and mature.
