Full Report
GitLab has released security updates to address multiple vulnerabilities in the company's DevSecOps platform, including ones enabling attackers to take over accounts and inject malicious jobs in future pipelines. [...]
Analysis Summary
# Vulnerability: GitLab High Severity Account Takeover and Other Flaws
## CVE Details
- CVE ID: *Not fully specified in the provided text for the main finding, but CVE-2025-2254 and CVE-2025-0673 are mentioned for secondary flaws.*
- CVSS Score: High Severity (*Implied for the main account takeover issue*)
- CWE: *Not specified*
## Affected Systems
- Products: GitLab DevSecOps Platform
- Versions: *Specific vulnerable versions are not listed in the provided text.*
- Configurations: Successful exploitation of the main flaw requires **authenticated access** to GitLab instances that possess a **GitLab Ultimate license**.
## Vulnerability Description
The primary vulnerability allows for a **high severity account takeover**. The flaw is related to the **GitLab Sequences** system feature, which allows for sequential code changes/processes or parallel execution of tasks. Successful exploitation leads to an unauthorized takeover of an account.
Additionally, two other vulnerabilities were patched:
1. **CVE-2025-2254:** A Cross-Site Scripting (XSS) vulnerability that could allow successful attackers to act in the context of a legitimate user.
2. **CVE-2025-0673:** A Denial of Service (DoS) flaw allowing malicious actors to trigger infinite redirect loops, causing memory exhaustion and denial of access to legitimate users.
## Exploitation
- Status: *Not explicitly stated if the main flaw is exploited in the wild; the focus is on patching.*
- Complexity: *Not specified, but account takeover vulnerabilities often rank Medium to High.*
- Attack Vector: *Not specified, but account takeover/XSS typically require Network access.*
## Impact
- Confidentiality: *High (implied by account takeover)*
- Integrity: *High (implied by account takeover and XSS)*
- Availability: *Medium/High (due to CVE-2025-0673 DoS)*
## Remediation
### Patches
- Patches are available from GitLab for the issues summarized above (account takeover, XSS CVE-2025-2254, DoS CVE-2025-0673).
- *Specific fixed versions are not provided in the source text.*
### Workarounds
- No specific workarounds are mentioned in the provided text.
## Detection
- Detection strategies/IOCs are not provided in the source article snippet.
## References
- Vendor Advisory: [https://www.bleepingcomputer.com/news/security/gitlab-patches-high-severity-account-takeover-missing-auth-issues/](https://www.bleepingcomputer.com/news/security/gitlab-patches-high-severity-account-takeover-missing-auth-issues/)
- CVE-2025-2254 Reference: cve dot mitre dot org/cgi-bin/cvename dot cgi?name=CVE-2025-2254 (Defanged)
- CVE-2025-0673 Reference: cve dot mitre dot org/cgi-bin/cvename dot cgi?name=CVE-2025-0673 (Defanged)