PT-2026-1715 · Gitlab · Gitlab Ce/Ee

Published 2026-01-07 · Updated 2026-01-09 · CVE-2025-13781

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions GitLab EE versions 18.5 through 18.5.4 GitLab EE versions 18.6 through 18.6.2 GitLab EE versions 18.7 through 18.7.0

Description An authenticated user could modify instance-wide AI feature provider settings due to missing authorization checks in GraphQL mutations. The issue affects GitLab EE. The vulnerability allows modification of settings related to AI features. The affected functionality involves GraphQL mutations, which are used to modify data in the GitLab system.

Recommendations GitLab EE version 18.5.5 or later GitLab EE version 18.6.3 or later GitLab EE version 18.7.1 or later

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2026-02071

BIT-GITLAB-2025-13781

CVE-2025-13781

Affected Products

Gitlab Ce/Ee

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/13xxx/CVE-2025-13781.json · Exploit
• 🔥 https://hackerone.com/reports/3400940 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-13781 · Security Note
• https://about.gitlab.com/releases/2026/01/07/patch-release-gitlab-18-7-1-released · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-13781 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02071 · Security Note
• https://twitter.com/VulmonFeeds/status/2009674761211609309 · Twitter Post
• https://twitter.com/CVEnew/status/2009578260745830415 · Twitter Post
• https://t.me/CVEtracker/41813 · Telegram Post
• https://gitlab.com/gitlab-org/gitlab/-/issues/578756 · Note