CVE-2025-9825
Missing Authorization in GitLab
Summary
Missing Authorization in GitLab
Original description
The description as published by the source.
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 to 18.2.8, 18.3 before 18.3.4, and 18.4 before 18.4.2 that could have allowed authenticated users without project membership to view sensitive manual CI/CD variables by querying the GraphQL API.
Affected packages
Bitnami
gitlab
[{"type":"SEMVER","events":[{"introduced":"13.7.0"},{"fixed":"18.2.8"},{"introduced":"18.3.0"},{"fixed":"18.3.4"},{"introduced":"18.4.0"},{"fixed":"18.4.2"}]}]
References
- advisory nvd.nist.gov
- advisory github.com
- package git://git@gitlab.com:gitlab-org/gitlab.git
- report gitlab.com
- report hackerone.com
- web about.gitlab.com