CVE-2025-1110: Insufficient Granularity of Access Control in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 18.0 before 18.0.1. In certain circumstances, a user with limited permissions could access Job Data via a crafted GraphQL query.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.0.1 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 18.0.1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-1110?
CVE-2025-1110 has been classified as a high-severity vulnerability.
How do I fix CVE-2025-1110?
To fix CVE-2025-1110, upgrade GitLab CE/EE to version 18.0.1 or later.
What cause CVE-2025-1110?
CVE-2025-1110 is caused by insufficient access control allowing limited users to access sensitive Job Data through a crafted GraphQL query.
Which versions of GitLab are affected by CVE-2025-1110?
CVE-2025-1110 affects all versions of GitLab CE/EE from 18.0 before 18.0.1.
What type of attack is CVE-2025-1110 associated with?
CVE-2025-1110 is associated with unauthorized data access attacks via GraphQL queries.