BaseFortify

Publication date: 2025-11-21

Last updated on: 2025-12-02

Assigner: GitLab Inc.

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 to 18.2.8, 18.3 before 18.3.4, and 18.4 before 18.4.2 that could have allowed authenticated users without project membership to view sensitive manual CI/CD variables by querying the GraphQL API.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-21

Last Modified

2025-12-02

Generated

2026-07-06

AI Q&A

2025-11-21

EPSS Evaluated

2026-07-05

NVD

CVE-2025-9825

Affected Vendors & Products

Vendor	Product	Version / Range
gitlab	gitlab	From 13.7.0 (inc) to 18.2.8 (exc)
gitlab	gitlab	From 13.7.0 (inc) to 18.2.8 (exc)
gitlab	gitlab	From 18.3.0 (inc) to 18.3.4 (exc)
gitlab	gitlab	From 18.3.0 (inc) to 18.3.4 (exc)
gitlab	gitlab	From 18.4.0 (inc) to 18.4.2 (exc)
gitlab	gitlab	From 18.4.0 (inc) to 18.4.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in GitLab CE/EE allowed authenticated users who were not members of a project to view sensitive manual CI/CD variables by querying the GraphQL API. It affected multiple versions before being remediated.

Impact Analysis

The vulnerability could lead to unauthorized disclosure of sensitive CI/CD variables, potentially exposing secrets or credentials that could be misused, impacting the security of your projects and infrastructure.

Mitigation Strategies

Upgrade GitLab CE/EE to a version later than 18.2.8, 18.3.4, or 18.4.2 depending on your current version. Ensure that only authorized users have access to the GraphQL API to prevent unauthorized viewing of sensitive manual CI/CD variables.

Hi! I’m here to help you understand CVE-2025-9825. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70