CVE-2025-1278: Insufficient Granularity of Access Control in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 12.0 before 17.9.8, 17.10 before 17.10.6, and 17.11 before 17.11.2. Under certain conditions users could bypass IP access restrictions and view sensitive information.
Other sources
An issue has been discovered in GitLab CE/EE affecting all versions from 12.0 before 17.9.8, 17.10 before 17.10.6, and 17.11 before 17.11.2. Under certain conditions users could bypass IP access restrictions of a group, enabling them to disclose sensitive information. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3). It is now mitigated in the latest release and is assigned CVE-2025-1278.
— GitLab
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-1278?
CVE-2025-1278 is considered to have a high severity due to its potential to allow unauthorized access to sensitive information.
How do I fix CVE-2025-1278?
To fix CVE-2025-1278, upgrade GitLab CE/EE to versions 17.9.8, 17.10.6, or 17.11.2 and later.
What versions are affected by CVE-2025-1278?
CVE-2025-1278 affects all GitLab CE/EE versions from 12.0 before 17.9.8, 17.10 before 17.10.6, and 17.11 before 17.11.2.
What is the impact of CVE-2025-1278?
The impact of CVE-2025-1278 allows users to bypass IP access restrictions, potentially leading to exposure of sensitive information.
Are there any workarounds for CVE-2025-1278?
There are no known effective workarounds for CVE-2025-1278, so upgrading is the recommended solution.