CVE-2025-13928: Incorrect Authorization in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.7 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have allowed an unauthenticated user to cause a denial of service condition by exploiting incorrect authorization validation in API endpoints.
Other sources
GitLab has remediated an issue that could have allowed an unauthenticated user to cause a denial of service condition by exploiting incorrect authorization validation in API endpoints.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-13928?
CVE-2025-13928 is classified as a high severity vulnerability due to its potential to allow unauthenticated users to cause denial of service conditions.
How do I fix CVE-2025-13928?
To fix CVE-2025-13928, upgrade GitLab to version 18.6.4, 18.7.2, or 18.8.2.
Which GitLab versions are affected by CVE-2025-13928?
CVE-2025-13928 affects GitLab CE/EE versions from 17.7 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2.
What causes CVE-2025-13928 in GitLab?
CVE-2025-13928 is caused by an incorrect authorization issue in the Releases API of GitLab.
Is a workaround available for CVE-2025-13928?
No official workaround is provided for CVE-2025-13928, and upgrading to the patched versions is strongly recommended.