PT-2025-50576 · Gitlab · Gitlab Ce/Ee

Weasterhacker · Published 2025-12-10 · Updated 2025-12-11 · CVE-2025-11247

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab EE versions 13.2 through 18.4.5 GitLab EE versions 18.5 through 18.5.3 GitLab EE versions 18.6 through 18.6.1

Description An authenticated user could potentially disclose sensitive information from private projects by executing specifically crafted GraphQL queries. The issue affects GitLab EE.

Recommendations GitLab EE versions prior to 18.4.6 should be updated. GitLab EE versions prior to 18.5.4 should be updated. GitLab EE versions prior to 18.6.2 should be updated.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

BDU:2025-15862

BIT-GITLAB-2025-11247

CVE-2025-11247

Affected Products

Gitlab Ce/Ee

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11247.json · Exploit
• 🔥 https://hackerone.com/reports/3307422 · Exploit
• https://bdu.fstec.ru/vul/2025-15862 · Security Note
• https://about.gitlab.com/releases/2025/12/10/patch-release-gitlab-18-6-2-released · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-11247 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11247 · Security Note
• https://t.me/cveNotify/145409 · Telegram Post
• https://twitter.com/CVEnew/status/1999108871928136052 · Twitter Post
• https://gitlab.com/gitlab-org/gitlab/-/issues/573766 · Note
• https://t.me/CVEtracker/39441 · Telegram Post