CVE-2025-6195: Direct Request ('Forced Browsing') in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 13.7 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed an authenticated user to view information from security reports under certain configuration conditions.
Other sources
GitLab has remediated an issue that could have allowed an authenticated user to view information from security reports under certain configuration conditions.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-6195?
The severity of CVE-2025-6195 is categorized as a medium vulnerability due to its ability to expose sensitive information under specific configurations.
How do I fix CVE-2025-6195?
To fix CVE-2025-6195, upgrade your GitLab EE installation to version 18.4.5, 18.5.3, or 18.6.1 or later.
What versions are affected by CVE-2025-6195?
CVE-2025-6195 affects GitLab EE versions from 13.7 up to but not including 18.4.5, 18.5 up to but not including 18.5.3, and 18.6 up to but not including 18.6.1.
What type of user can exploit CVE-2025-6195?
An authenticated user can potentially exploit CVE-2025-6195 to access unauthorized information from security reports.
Is there a public exploit for CVE-2025-6195?
Currently, there are no known public exploits specifically targeting CVE-2025-6195.