CVE-2025-13772: Missing Authorization in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to access and utilize AI model settings from unauthorized namespaces by manipulating namespace identifiers in API requests.
Other sources
GitLab has remediated an issue that could have allowed an authenticated user to access and utilize AI model settings from unauthorized namespaces by manipulating namespace identifiers in API requests.
— GitLab
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.5.5Fixed in 18.6.3Fixed in 18.7.1 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 18.5.5 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 18.6.3 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 18.7.1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-13772?
CVE-2025-13772 is rated as a medium severity vulnerability.
How do I fix CVE-2025-13772?
To fix CVE-2025-13772, upgrade GitLab EE to version 18.5.6, 18.6.4, or 18.7.2 or later.
What kind of access does CVE-2025-13772 allow?
CVE-2025-13772 allows an authenticated user to gain unauthorized access to AI model settings in different namespaces.
Which versions of GitLab are affected by CVE-2025-13772?
CVE-2025-13772 affects GitLab EE versions from 18.4 up to 18.5.5, 18.6.3, and 18.7.1.
How can I know if my GitLab instance is vulnerable to CVE-2025-13772?
Check your GitLab EE version against the affected ranges for CVE-2025-13772 to determine if you are vulnerable.