CVE-2025-7001: Insufficient Granularity of Access Control in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 15.0 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that could have allowed priviledged users to access certain resourcegroup information through the API which should have been unavailable.
Other sources
GitLab has remediated an issue that could have allowed privileged users to access certain resourcegroup information through the API which should have been unavailable.
— GitLab
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.0.5Fixed in 18.1.3Fixed in 18.2.1 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 18.0.5 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 18.1.3 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 18.2.1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-7001?
CVE-2025-7001 has been categorized as a medium severity vulnerability.
How do I fix CVE-2025-7001?
To mitigate CVE-2025-7001, you should upgrade GitLab CE/EE to version 18.0.5, 18.1.3, or 18.2.1 or later.
Who is affected by CVE-2025-7001?
CVE-2025-7001 affects all versions of GitLab CE/EE from 15.0 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1.
What impact does CVE-2025-7001 have on GitLab users?
CVE-2025-7001 could allow privileged users to access restricted resource_group information through the API.
Is CVE-2025-7001 a remote or local vulnerability?
CVE-2025-7001 is considered a local vulnerability as it requires privileged access to exploit.