CVEvulnerability
CVE-2025-12575
5.4 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2026-02-11
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weaknesses
- CWE-918
Description
GitLab has remediated an issue in GitLab EE affecting all versions from 18.0 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user with certain permissions to make unauthorized requests to internal network services through the GitLab server.
Affected configurations
• gitlab gitlab (>= 18.0.0 < 18.6.6)
• gitlab gitlab (>= 18.7.0 < 18.7.4)
• gitlab gitlab (>= 18.8.0 < 18.8.4)
Related
Weakness · CWE (1)
- CWE-918 Server-Side Request Forgery weakness
References
- https://about.gitlab.com/releases/2026/02/10/patch-release-gitlab-18-8-4-released/ Release Notes, Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/579171 Broken Link, Issue Tracking
- https://hackerone.com/reports/3397752 Permissions Required