PT-2026-1714 · Gitlab · Gitlab Ce/Ee
Published
2026-01-07
·
Updated
2026-01-13
·
CVE-2025-13772
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:S/C:C/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
GitLab EE versions 18.4 through 18.5.4
GitLab EE versions 18.6 through 18.6.2
GitLab EE versions 18.7 through 18.7.0
Description
An authenticated user could potentially access and utilize AI model settings from unauthorized namespaces. This access is achieved by manipulating namespace identifiers in API requests. The issue affects the
/api/v1/ai/models endpoint, where the namespace id parameter is vulnerable to manipulation. An attacker with valid credentials can potentially bypass authorization checks and gain access to AI model settings belonging to other namespaces.Recommendations
GitLab EE versions 18.4 through 18.5.4 should be upgraded to version 18.5.5 or later.
GitLab EE versions 18.6 through 18.6.2 should be upgraded to version 18.6.3 or later.
GitLab EE versions 18.7 through 18.7.0 should be upgraded to version 18.7.1 or later.
Exploit
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Gitlab Ce/Ee