PT-2025-34931 · Gitlab · Gitlab Ce/Ee

Published

2025-08-27

·

Updated

2025-08-30

·

CVE-2025-2246

Report an issue
CVSS v3.1
5.8
VectorAV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions:

GitLab CE/EE versions prior to 18.1.5

GitLab CE/EE versions 18.2 through 18.2.5

GitLab CE/EE versions prior to 18.3.1

Description:

An issue exists in GitLab CE/EE that allows unauthenticated users to access sensitive manual CI/CD variables by querying the GraphQL `API`.

Recommendations:

Update GitLab CE/EE to version 18.1.5 or later.

Update GitLab CE/EE to version 18.2.5 or later.

Update GitLab CE/EE to version 18.3.1 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BIT-GITLAB-2025-2246
CVE-2025-2246

Affected Products

Gitlab Ce/Ee