CVE-2025-5195: Authorization Bypass Through User-Controlled Key in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. It was possible for authenticated users to access arbitrary compliance frameworks, leading to unauthorized data disclosure.
Other sources
GitLab has remediated an issue that could have allowed authenticated users to gain access to data beyond their privilege boundaries by accessing arbitrary compliance frameworks. Impacted versions GitLab CE/EE: all versions from 17.9 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-5195?
CVE-2025-5195 is considered a moderate severity vulnerability due to its potential for unauthorized data disclosure.
How do I fix CVE-2025-5195?
To fix CVE-2025-5195, upgrade GitLab CE/EE to versions 17.10.7, 17.11.3, or 18.0.1 or later.
Who is affected by CVE-2025-5195?
CVE-2025-5195 affects all authenticated users of GitLab CE/EE versions prior to the specified updates.
What type of vulnerability is CVE-2025-5195?
CVE-2025-5195 is a data disclosure vulnerability that allows access to arbitrary compliance frameworks.
Is there a workaround for CVE-2025-5195 until I can update?
No specific workaround is recommended for CVE-2025-5195; upgrading is the best action to mitigate the vulnerability.