{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-01T02:08:53.901","vulnerabilities":[{"cve":{"id":"CVE-2025-5315","sourceIdentifier":"cve@gitlab.com","published":"2025-06-26T06:15:23.873","lastModified":"2026-06-17T09:47:39.780","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users with Guest role permissions to add child items to incident work items by sending crafted API requests that bypassed UI-enforced role restrictions."},{"lang":"es","value":"Se descubrió un problema en GitLab CE/EE que afecta a todas las versiones desde la 17.2 hasta la 17.11.5, la 18.0 hasta la 18.0.3 y la 18.1 hasta la 18.1.1 que podría haber permitido a los usuarios autenticados con permisos de rol de Invitado agregar elementos secundarios a los elementos de trabajo del incidente mediante el envío de solicitudes de API manipuladas que eludían las restricciones de rol impuestas por la interfaz de usuario."}],"affected":[{"source":"cve@gitlab.com","affectedData":[{"vendor":"GitLab","product":"GitLab","defaultStatus":"unaffected","cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"repo":"git://git@gitlab.com:gitlab-org/gitlab.git","versions":[{"version":"17.2","lessThan":"17.11.5","versionType":"semver","status":"affected"},{"version":"18.0","lessThan":"18.0.3","versionType":"semver","status":"affected"},{"version":"18.1","lessThan":"18.1.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@gitlab.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-06-26T13:22:37.271723Z","id":"CVE-2025-5315","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@gitlab.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"17.2.0","versionEndExcluding":"17.11.5","matchCriteriaId":"E561C0D3-12B9-432E-9FAC-4C7B7D5EEC38"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"17.2.0","versionEndExcluding":"17.11.5","matchCriteriaId":"61CA81F1-7FD4-4616-84FA-F23243CDB4C8"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"18.0.0","versionEndExcluding":"18.0.3","matchCriteriaId":"12A2A86E-8DD7-482C-8CAD-191E0E5C635D"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"18.0.0","versionEndExcluding":"18.0.3","matchCriteriaId":"912DFFB2-0D98-4506-AEB6-2AC3C2330554"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:18.1.0:*:*:*:community:*:*:*","matchCriteriaId":"792C874D-21C4-4715-95B8-489B65F7AE0D"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:18.1.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"1FA1F1D0-87EA-44A6-AFB7-267BB21A7412"}]}]}],"references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/546282","source":"cve@gitlab.com","tags":["Broken Link"]},{"url":"https://hackerone.com/reports/3163037","source":"cve@gitlab.com","tags":["Permissions Required"]}]}}]}