PT-2026-7528 · Gitlab · Gitlab Ce/Ee

Published 2026-02-10 · Updated 2026-02-17 · CVE-2025-7659

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.2 through 18.6.6 GitLab CE/EE versions 18.7 through 18.7.4 GitLab CE/EE versions 18.8 through 18.8.4

Description An issue exists in GitLab CE/EE related to incomplete validation within the Web IDE. This could allow an unauthenticated user to obtain tokens and gain access to private repositories. The issue stems from a flaw in the source verification mechanism.

Recommendations GitLab versions 18.2 through 18.6.6 should be updated to version 18.6.7 or later. GitLab versions 18.7 through 18.7.4 should be updated to version 18.7.5 or later. GitLab versions 18.8 through 18.8.4 should be updated to version 18.8.5 or later.

Exploit

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

BDU:2026-01825

BIT-GITLAB-2025-7659

CVE-2025-7659

Affected Products

Gitlab Ce/Ee

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/7xxx/CVE-2025-7659.json · Exploit
• 🔥 https://hackerone.com/reports/3234976 · Exploit
• https://about.gitlab.com/releases/2026/02/10/patch-release-gitlab-18-8-4-released · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-7659 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-7659 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-7659 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-01825 · Security Note
• https://osv.dev/vulnerability/CVE-2025-7659 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2025-7659 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-7659 · Security Note
• https://twitter.com/CVEnew/status/2021554568098668943 · Twitter Post
• https://twitter.com/pulsepatchio/status/2023771787796865099 · Twitter Post
• https://gitlab.com/gitlab-org/gitlab/-/issues/555440 · Note
• https://twitter.com/cracbot/status/2023351728259899525 · Twitter Post
• https://twitter.com/CCBalert/status/2022242799131746743 · Twitter Post