CVE-2025-1278

Published: May 9, 2025Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 12.0 before 17.9.8, 17.10 before 17.10.6, and 17.11 before 17.11.2. Under certain conditions users could bypass IP access restrictions and view sensitive information.

Affected (6)

Products: Gitlab: Gitlab

Gitlab

1 product

Gitlab

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Gitlab Gitlab	12.0.0 ≤ version < 17.9.8
Gitlab Gitlab	17.10.0 ≤ version < 17.10.6
Gitlab Gitlab	17.11.0 ≤ version < 17.11.2
Gitlab Gitlab	12.0.0 ≤ version < 17.9.8
Gitlab Gitlab	17.10.0 ≤ version < 17.10.6
Gitlab Gitlab	17.11.0 ≤ version < 17.11.2

Related CWEs

CWE-1220

Insufficient Granularity of Access Control

The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.

References (2)

https://gitlab.com/gitlab-org/gitlab/-/issues/519580

Source: cve@gitlab.com

Broken Link

https://hackerone.com/reports/2977149

Source: cve@gitlab.com

Permissions Required

Timeline

No history available yet.