CVE-2025-0765: Incorrect Authorization in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that could have allowed an unauthorized user to access custom service desk email addresses.
Other sources
GitLab has remediated an issue that could have allowed an unauthorized user to access custom service desk email addresses.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-0765?
CVE-2025-0765 has a medium severity rating due to its potential to expose sensitive email addresses.
How do I fix CVE-2025-0765?
To mitigate CVE-2025-0765, upgrade GitLab CE/EE to version 18.0.5 or later, 18.1.3 or later, or 18.2.1 or later.
What versions are affected by CVE-2025-0765?
CVE-2025-0765 affects GitLab CE/EE versions from 17.9 up to but not including 18.0.5, from 18.1 up to but not including 18.1.3, and from 18.2 up to but not including 18.2.1.
Is CVE-2025-0765 remote exploitable?
Yes, CVE-2025-0765 can potentially be exploited by unauthorized users remotely to access custom service desk email addresses.
What impact does CVE-2025-0765 have on users?
CVE-2025-0765 could allow unauthorized access to user-specific custom service desk email addresses, affecting data confidentiality.