CVE-2025-10903: gitlab 19.3.0; +1 more affected products

Affected technology

gitlab · from 11.1.0 (inclusive), before 19.1.7 (exclusive)
gitlab

gitlab · from 19.2.0 (inclusive), before 19.2.5 (exclusive)
gitlab

gitlab · 19.3.0
gitlab

GitLab · 11.10 to before 19.1.7, 19.2 to before 19.2.5, 19.3 to before 19.3.1
GitLab

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

The source says gitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user could have caused denial of service, due to an unbounded loop triggered by specially crafted input in the SCIM user provisioning feature. Vendor/CNA’s CVSS 3.1 assessment (base score 6.5/10) rates confidentiality and integrity impact as none; availability impact as high.