CVE-2025-0652 - Incorrect Authorization in GitLab

Back Back to CVE browser

MEDIUM

Incorrect Authorization in GitLab

Published Mar 13, 2025

6.5

MEDIUM

CVSS 3.1

EPSS 0.41%

Description

An issue has been discovered in GitLab EE/CE affecting all versions starting from 16.9 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2 could allow unauthorized users to access confidential information intended for internal use only.

Affected products

Vendor GitLab Product GitLab Default
unaffected
- Version
  16.9
  Status
  affected
  Constraints
  <17.7.7
- Version
  17.8
  Status
  affected
  Constraints
  <17.8.5
- Version
  17.9
  Status
  affected
  Constraints
  <17.9.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

GitLab

unaffected

Version	Status	Constraints
16.9	affected	<17.7.7
17.8	affected	<17.8.5
17.9	affected	<17.9.2

Remediation

Vendor solution

Upgrade to versions 17.7.7, 17.8.5, 17.9.2.

Weaknesses (1)

CWE-863

Incorrect Authorization

References (2)

https://gitlab.com/gitlab-org/gitlab/-/issues/514532
issue-trackingpermissions-requiredBroken Link
https://hackerone.com/reports/2947863
technical-descriptionexploitpermissions-requiredPermissions Required

Link	Providers	Tags
https://gitlab.com/gitlab-org/gitlab/-/issues/514532		issue-trackingpermissions-requiredBroken Link
https://hackerone.com/reports/2947863		technical-descriptionexploitpermissions-requiredPermissions Required