CVE-2025-1042: Files or Directories Accessible to External Parties in GitLab
An improper access control vulnerability in GitLab EE affecting all versions from 15.7 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows a user with a custom permission to view contents of a repository even if that access is not authorized. This is a low severity issue (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, 2.7). It is now mitigated in the latest release and is assigned CVE-2025-1042.
Other sources
An insecure direct object reference vulnerability in GitLab EE affecting all versions from 15.7 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to view repositories in an unauthorized way.
— MITRE
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-1042?
The severity of CVE-2025-1042 is considered critical due to the potential unauthorized access to repositories.
How do I fix CVE-2025-1042?
To fix CVE-2025-1042, update your GitLab EE installation to version 17.6.5, 17.7.4, or 17.8.2 or later.
What versions are affected by CVE-2025-1042?
CVE-2025-1042 affects all versions of GitLab EE from 15.7 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2.
What type of vulnerability is CVE-2025-1042?
CVE-2025-1042 is an insecure direct object reference vulnerability.
What impacts can CVE-2025-1042 have on users?
CVE-2025-1042 can allow attackers to view repositories that they should not have access to, compromising data confidentiality.