GitLab Patches Two High-Severity Flaws in GraphQL API Affecting Both CE and EE Editions

GitLab has patched two high-severity flaws in its GraphQL API that affect both Community Edition (CE) and Enterprise Edition (EE) releases, with fixes in versions up to 18.4.2, 18.3.4, or 18.2.8.

The first vulnerability, CVE-2025-11340, affects EE and carries a CVSS v3.1 score of 7.7 (High); GitLab explains that it could allow authenticated users with read-only API tokens to perform unauthorized write operations on vulnerability records by exploiting incorrectly scoped GraphQL mutations, breaching intended permission boundaries.

According to GitLab advisory, “GitLab has remediated an issue that, under certain conditions, could have allowed authenticated users with read-only API tokens to perform unauthorized write operations on vulnerability records by exploiting incorrectly scoped GraphQL mutations.” The second flaw, CVE-2025-10004, affects both CE and EE and has a CVSS score of 7.5 (High); it resides

in the GraphQL blob type functionality and can be exploited remotely by sending crafted GraphQL queries requesting extremely large repository blobs, potentially making a GitLab instance unresponsive or significantly degraded, and it does not require authentication. Administrators are urged to upgrade promptly to mitigate these risks.