CVE-2025-11865
Medium · 4.3CVSS
4.3
EPSS
0.2%
Published
Nov 15, 2025
CISA due date
—
The record
An issue has been discovered in GitLab EE affecting all versions from 18.1 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that, under certain circumstances, could have allowed an attacker to remove Duo flows of another user.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Bitnami | gitlab | 18.1.0 | 18.3.6 |
Related vulnerabilities
- CVE-2026-1751 A vulnerability has been discovered in GitLab CE/EE affecting all versions starting with… Also affects gitlab
- CVE-2025-3950 Exposure of Private Personal Information to an Unauthorized Actor in GitLab Also affects gitlab
- CVE-2025-9222 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in… Also affects gitlab
- CVE-2025-10569 Allocation of Resources Without Limits or Throttling in GitLab Also affects gitlab
- CVE-2025-11246 Insufficient Granularity of Access Control in GitLab Also affects gitlab
- CVE-2025-13772 Missing Authorization in GitLab Also affects gitlab
- CVE-2025-13761 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in… Also affects gitlab
- CVE-2025-13781 Missing Authorization in GitLab Also affects gitlab