← Back

CVE-2025-7001

nvd nist
Published: Jul 24, 2025Modified: Jun 17, 2026

JSON object

Loading...
2.7
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Exploitability: 1.2 / Impact: 1.4
Source: NVD

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 15.0 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that could have allowed priviledged users to access certain resource_group information through the API which should have been unavailable.

Affected (6)

Products: Gitlab: Gitlab
Gitlab
1 product
Gitlab
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Gitlab
Gitlab
From 15.0.0 to 18.0.5
Gitlab
From 18.1.0 to 18.1.3
Gitlab
From 15.0.0 to 18.0.5
Gitlab
From 18.1.0 to 18.1.3
Gitlab
Version 18.2
Gitlab
Version 18.2

Related CWEs

CWE-1220
Insufficient Granularity of Access Control
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.

References (2)

Source: cve@gitlab.com
Broken Link
Source: cve@gitlab.com
Permissions Required

Timeline

No history available yet.