CVE-2025-2408: Insufficient Granularity of Access Control in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 13.12 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. Under certain conditions users could bypass IP access restrictions and view sensitive information.
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-2408?
CVE-2025-2408 has been rated as a critical severity vulnerability due to the potential to bypass IP access restrictions.
How do I fix CVE-2025-2408?
To fix CVE-2025-2408, upgrade your GitLab CE/EE to version 17.8.7, 17.9.6, or 17.10.4 or later.
What versions are affected by CVE-2025-2408?
CVE-2025-2408 affects GitLab CE/EE versions from 13.12 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4.
What information could be exposed due to CVE-2025-2408?
CVE-2025-2408 could allow unauthorized users to view sensitive information available within GitLab.
Who is impacted by CVE-2025-2408?
All users of GitLab CE/EE versions mentioned in the vulnerability are at risk of being impacted by CVE-2025-2408.