CVE-2025-9957

GitLab has remediated a CVE-2025-9957 authorization bypass vulnerability affecting GitLab Community and Enterprise editions versions 11.2 through 18.11.0, which allowed authenticated project owners to circumvent group fork prevention controls through improper authorization checks. The vulnerability requires high privileges to exploit, as the attacker must already possess project owner permissions, and operates over the network with low attack complexity. The CVSS score of 2.7 reflects low severity with limited impact, specifically limited integrity violation and no confidentiality or availability effects. Currently, there is no evidence of active exploitation in the wild, no public exploit code is available, and the vulnerability has not been prioritized for federal inclusion in the Known Exploited Vulnerabilities catalog. Community attention remains minimal as indicated by the low EPSS score of 0.0001, suggesting this issue poses minimal risk in practical threat environments.