CVE-2025-0652: Incorrect Authorization in GitLab
An issue has been discovered in GitLab EE/CE affecting all versions starting from 16.9 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2 could allow unauthorized users to access confidential information intended for internal use only.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.7.7Fixed in 17.8.5Fixed in 17.9.2 - Upgrade
Upgrade
GitLab EE/CEto a version that resolves this vulnerability.Fixed in 17.7.7 - Upgrade
Upgrade
GitLab EE/CEto a version that resolves this vulnerability.Fixed in 17.8.5 - Upgrade
Upgrade
GitLab EE/CEto a version that resolves this vulnerability.Fixed in 17.9.2
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-0652?
CVE-2025-0652 is considered a critical vulnerability due to its potential to expose confidential information to unauthorized users.
How do I fix CVE-2025-0652?
To fix CVE-2025-0652, upgrade your GitLab EE/CE to version 17.8.5 or later, or to version 17.9.2 or later.
What versions are affected by CVE-2025-0652?
CVE-2025-0652 affects GitLab EE/CE versions from 16.9 to 17.7.7, from 17.8 to 17.8.5, and from 17.9 to 17.9.2.
What kind of information can be exposed by CVE-2025-0652?
CVE-2025-0652 allows unauthorized users to access confidential information intended for internal users only.
Is there a workaround for CVE-2025-0652?
There are no known workarounds for CVE-2025-0652; users must upgrade to a patched version to mitigate the risk.