Security readout for executives and security teams
Plain-English summary
A GitLab Enterprise Edition permissions flaw could grant a user with pending membership privileges from a custom role before membership was fully active. Exploitation requires restrictive conditions and could expose or alter limited data, but does not affect availability. GitLab rates the issue low severity.
Executive priority
Schedule remediation through normal patch management, prioritizing internet-accessible GitLab EE instances that use custom roles and pending invitations. Immediate emergency response is not supported by the supplied evidence, but access reviews are prudent because the flaw concerns authorization boundaries.
Technical view
CVE-2025-9486 is a CWE-266 incorrect privilege assignment issue in GitLab EE. Membership-state handling could apply custom-role permissions to a pending member. It affects versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2. CVSS 3.1 is 3.3: network-accessible, high complexity, high privileges required, with low confidentiality and integrity impact.
Likely exposure
Exposure is limited to affected GitLab EE installations using custom roles where users have pending memberships. GitLab Community Edition is not identified as affected. Instances already running 19.0.6, 19.1.4, 19.2.2, or an appropriate later fixed release fall outside the stated vulnerable ranges.
Exploitation context
The supplied evidence does not establish active exploitation, and the CVE is not listed as KEV. Exploitation requires high privileges and high complexity according to the CVSS vector. Detailed triggering conditions are unavailable in the supplied bundle because the linked technical reports require permissions.
Researcher notes
The vulnerable behavior is membership-state-dependent custom-role authorization. CVSS indicates AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N. The available bundle does not disclose the precise conditions, affected permission combinations, telemetry, or a reproducible trigger, so deeper validation should follow GitLab's restricted reports and vendor guidance.
Mitigation direction
- Upgrade affected GitLab EE 19.0 installations to 19.0.6 or an appropriate later fixed release.
- Upgrade 19.1 installations to 19.1.4 or later, and 19.2 installations to 19.2.2 or later.
- Review GitLab vendor guidance before upgrading older release branches.
- Restrict creation of pending memberships and assignment of custom roles until remediation is complete.
Validation and detection
- Confirm each GitLab instance's edition and exact installed version.
- Identify projects or groups using custom roles with pending memberships.
- Review pending members for permissions inconsistent with their membership state.
- After upgrading, verify pending members cannot exercise custom-role permissions.
- Review relevant audit records for unexpected access or changes by pending members.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-266: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-9486 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 3.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N0.72.5GitLabVulnerability scoring details
Base CVSS 3.1 score
3.3LowVector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- GitLab Issue #565412CVE reference, GitLab · issue-tracking, permissions-required
- HackerOne Bug Bounty Report #3262844CVE reference, GitLab · technical-description, exploit
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-2-released/CVE reference, GitLab
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Privilege Assignment
Incorrect Privilege Assignment represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.