PT-2026-1715 · Gitlab · Gitlab Ce/Ee

CVE-2025-13781 · Publicado 2026-01-07 · Atualizado 2026-01-09

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions GitLab EE versions 18.5 through 18.5.4 GitLab EE versions 18.6 through 18.6.2 GitLab EE versions 18.7 through 18.7.0

Description An authenticated user could modify instance-wide AI feature provider settings due to missing authorization checks in GraphQL mutations. The issue affects GitLab EE. The vulnerability allows modification of settings related to AI features. The affected functionality involves GraphQL mutations, which are used to modify data in the GitLab system.

Recommendations GitLab EE version 18.5.5 or later GitLab EE version 18.6.3 or later GitLab EE version 18.7.1 or later

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

BDU:2026-02071

BIT-GITLAB-2025-13781

CVE-2025-13781

Produtos afetados

Gitlab Ce/Ee

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/13xxx/CVE-2025-13781.json · Exploit
• 🔥 https://hackerone.com/reports/3400940 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-13781 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2009674761211609309 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2009578260745830415 · Publicação no Twitter
• https://about.gitlab.com/releases/2026/01/07/patch-release-gitlab-18-7-1-released · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2025-13781 · Aviso do Fabricante
• https://t.me/CVEtracker/41813 · Publicação no Telegram
• https://gitlab.com/gitlab-org/gitlab/-/issues/578756 · Nota
• https://bdu.fstec.ru/vul/2026-02071 · Nota de Segurança