CVE-2025-1299: Missing Authorization in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 18.0.5, all versions starting from 18.1 before 18.1.3, all versions starting from 18.2 before 18.2.1 that, under circumstances, could have allowed an unauthorized user to read deployment job logs by sending a crafted request.
Other sources
GitLab has remediated an issue that, under circumstances, could have allowed an unauthorized user to read deployment job logs by sending a crafted request.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-1299?
CVE-2025-1299 has been classified as a high-severity vulnerability due to the risk of unauthorized access to sensitive deployment job information.
How do I fix CVE-2025-1299?
To fix CVE-2025-1299, upgrade your GitLab CE/EE to versions 18.0.5, 18.1.3, or 18.2.1 or later.
Which versions of GitLab are affected by CVE-2025-1299?
CVE-2025-1299 affects GitLab versions from 15.4 to prior to 18.0.5, from 18.1 to prior to 18.1.3, and from 18.2 to prior to 18.2.1.
What type of vulnerability is CVE-2025-1299?
CVE-2025-1299 is a security vulnerability that allows unauthorized users to read information related to deployment jobs.
Who reported CVE-2025-1299?
CVE-2025-1299 was reported through community channels, highlighting potential risks associated with access control within GitLab.