CVE-2025-11247
BaseFortify
Publication date: 2025-12-11
Last updated on: 2025-12-11
Assigner: GitLab Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gitlab | gitlab | 18.6 |
| gitlab | gitlab | 13.2 |
| gitlab | gitlab | 18.4 |
| gitlab | gitlab | 18.5 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
The vulnerability could lead to unauthorized disclosure of sensitive information from private projects to authenticated users, potentially exposing confidential data.
Can you explain this vulnerability to me?
This vulnerability in GitLab EE allowed an authenticated user to disclose sensitive information from private projects by executing specially crafted GraphQL queries. It affected all versions from 13.2 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update GitLab EE to a fixed version: 18.4.6 or later if using 18.4.x, 18.5.4 or later if using 18.5.x, or 18.6.2 or later if using 18.6.x. Avoid using affected versions from 13.2 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 to prevent sensitive information disclosure via crafted GraphQL queries.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability could potentially affect compliance with standards like GDPR and HIPAA because it allows an authenticated user to disclose sensitive information from private projects. Unauthorized disclosure of sensitive data may lead to violations of data protection and privacy regulations. However, the impact is limited to confidentiality without affecting integrity or availability, and the vulnerability has been remediated in specific patch releases. Organizations should upgrade promptly to mitigate compliance risks. [1]