CVE-2025-13772
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2026-01-09

Last updated on: 2026-01-09

Assigner: GitLab Inc.

Description
GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to access and utilize AI model settings from unauthorized namespaces by manipulating namespace identifiers in API requests.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-09
Last Modified
2026-01-09
Generated
2026-06-16
AI Q&A
2026-01-10
EPSS Evaluated
2026-06-14
NVD
CVE-2025-13772
EUVD
EUVD-2026-1768
Affected Vendors & Products
Showing 5 associated CPEs
Vendor Product Version / Range
gitlab gitlab 18.4
gitlab gitlab to 18.5.5 (exc)
gitlab gitlab to 18.6.3 (exc)
gitlab gitlab to 18.7.1 (exc)
gitlab gitlab to 18.5.4 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Impact Analysis

An attacker with valid authentication could exploit this vulnerability to access AI model settings from unauthorized namespaces, potentially leading to unauthorized disclosure of sensitive configuration data and misuse of AI models.

Mitigation Strategies

To mitigate this vulnerability, you should immediately upgrade GitLab EE to version 18.5.5 or later, 18.6.3 or later, or 18.7.1 or later, as these versions include patches that fix the issue. Applying these patch releases will prevent authenticated users from accessing AI model settings from unauthorized namespaces. [1]

Executive Summary

This vulnerability in GitLab Enterprise Edition allows an authenticated user to access and use AI model settings from namespaces they are not authorized to access by manipulating namespace identifiers in API requests.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-13772. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart