CVE-2025-5982: Insufficient Granularity of Access Control in GitLab
An issue has been discovered in GitLab EE affecting all versions from 12.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Under certain conditions users could bypass IP access restrictions and view sensitive information.
Other sources
GitLab has remediated an issue that could have allowed a successful attacker to bypass IP access restrictions and view sensitive group information. Impacted versions GitLab EE: versions from 12.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2.CVSS 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-5982?
CVE-2025-5982 is considered a high severity vulnerability due to its potential to allow unauthorized access to sensitive information.
How do I fix CVE-2025-5982?
To fix CVE-2025-5982, upgrade GitLab EE to version 17.10.8 or later, 17.11.4 or later, or 18.0.2 or later.
What versions of GitLab EE are affected by CVE-2025-5982?
CVE-2025-5982 affects GitLab EE versions from 12.0 up to but not including 17.10.8, 17.11 up to but not including 17.11.4, and 18.0 up to but not including 18.0.2.
What type of information can be exposed due to CVE-2025-5982?
CVE-2025-5982 can potentially expose sensitive user information when IP access restrictions are bypassed.
Under what conditions can CVE-2025-5982 be exploited?
CVE-2025-5982 can be exploited under certain network conditions that allow bypassing IP access restrictions implemented in GitLab EE.