CVE-2025-11247: Authorization Bypass Through User-Controlled Key in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 13.2 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to disclose sensitive information from private projects by executing specifically crafted GraphQL queries.
Other sources
GitLab has remediated an issue that could have allowed a user to disclose sensitive information from private projects by executing specifically crafted GraphQL queries.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-11247?
CVE-2025-11247 has been classified as a significant vulnerability due to its potential to expose sensitive information from private GitLab projects.
How do I fix CVE-2025-11247?
To remediate CVE-2025-11247, upgrade to GitLab versions 18.4.6, 18.5.4, or 18.6.2.
What type of information can be disclosed by exploiting CVE-2025-11247?
Exploitation of CVE-2025-11247 could allow the disclosure of sensitive information stored in private GitLab projects.
Which versions of GitLab are affected by CVE-2025-11247?
CVE-2025-11247 affects GitLab EE versions prior to 18.4.6, 18.5.4, and 18.6.2.
Is there a workaround for CVE-2025-11247?
There are no public workarounds for CVE-2025-11247; upgrading to the patched versions is the recommended action.