CVE-2025-0765 - Incorrect Authorization in GitLab

Back Back to CVE browser

MEDIUM

Incorrect Authorization in GitLab

Published Jul 24, 2025

4.3

MEDIUM

CVSS 3.1

EPSS 0.41%

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that could have allowed an unauthorized user to access custom service desk email addresses.

Affected products

Vendor GitLab Product GitLab Default
unaffected
- Version
  17.9
  Status
  affected
  Constraints
  <18.0.5
- Version
  18.1
  Status
  affected
  Constraints
  <18.1.3
- Version
  18.2
  Status
  affected
  Constraints
  <18.2.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

GitLab

unaffected

Version	Status	Constraints
17.9	affected	<18.0.5
18.1	affected	<18.1.3
18.2	affected	<18.2.1

Remediation

Vendor solution

Upgrade to versions 18.0.5, 18.1.3, 18.2.1 or above.

Weaknesses (1)

CWE-863

Incorrect Authorization

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-22487
Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/515381
issue-trackingpermissions-requiredBroken Link
https://hackerone.com/reports/2956315
technical-descriptionexploitpermissions-requiredPermissions Required

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-22487		Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/515381		issue-trackingpermissions-requiredBroken Link
https://hackerone.com/reports/2956315		technical-descriptionexploitpermissions-requiredPermissions Required