CVE-2025-11865

An issue has been discovered in GitLab EE affecting all versions from 18.1 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that, under certain circumstances, could have allowed an attacker to remove Duo flows of another user.

CVSS 3.1

5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.2% chance of exploitation in the next 30 days; higher than 14% of CVEs (scores of 2026-10-25)

CWE

CWE-863

Published

2025-11-15

Modified

2026-10-19

Record from

the NVD, synced 2026-10-19

Affected

• gitlab:gitlab

References

• https://about.gitlab.com/releases/2025/11/12/patch-release-gitlab-18-5-2-released/
• https://gitlab.com/gitlab-org/gitlab/-/issues/561399

Check your stackJSON