CVE-2025-14562

score

0.1

cvss

3.1

epss

0.3%

published

2026-07-29

kev added

—

first seen

2026-10-21

GitLab CE/EE >= 10.6 < 19.0.5, 19.1 < 19.1.3, and 19.2 < 19.2.1 contain a broken access control vulnerability caused by improper authorization checks on merge request collaboration settings, letting authenticated users with developer role commit changes after removal, exploit requires developer role and prior membership.