PT-2025-47053 · Gitlab · Gitlab Ce/Ee

Published 2025-11-12 · Updated 2025-11-19 · CVE-2025-7736

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 17.9 through 18.3.5 GitLab CE/EE versions 18.4 through 18.4.3 GitLab CE/EE versions 18.5 through 18.5.1

Description An authenticated attacker could bypass access control restrictions and view GitLab Pages content intended only for project members. This was achieved by authenticating through OAuth providers. The issue affects GitLab CE/EE.

Recommendations Update GitLab CE/EE to version 18.3.6 or later. Update GitLab CE/EE to version 18.4.4 or later. Update GitLab CE/EE to version 18.5.2 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2025-14461

BIT-GITLAB-2025-7736

CVE-2025-7736

Affected Products

Gitlab Ce/Ee

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/7xxx/CVE-2025-7736.json · Exploit
• 🔥 https://hackerone.com/reports/3250156 · Exploit
• https://bdu.fstec.ru/vul/2025-14461 · Security Note
• https://about.gitlab.com/releases/2025/11/12/patch-release-gitlab-18-5-2-released · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-7736 · Security Note
• https://osv.dev/vulnerability/CVE-2025-7736 · Vendor Advisory
• https://t.me/CVEtracker/37421 · Telegram Post
• https://twitter.com/AnonOzzyDude/status/1991237721768227058 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1989614472462225764 · Twitter Post
• https://t.me/cveNotify/143416 · Telegram Post
• https://gitlab.com/gitlab-org/gitlab/-/issues/556098 · Note
• https://twitter.com/CVEnew/status/1989608989794164935 · Twitter Post
• https://t.me/cveNotify/142917 · Telegram Post