Skip to content
OpenAdvisories
High NCSC-2025-0377 6 CVEs

Kwetsbaarheden verholpen in GitLab

Published Nov 27, 2025 · Updated Nov 27, 2025 · nl

Vendor: GitLab Product: Community Edition, Enterprise Edition

Summary

GitLab heeft kwetsbaarheden verholpen in zijn Community Edition (CE) en Enterprise Edition (EE) versies.

Details

Interpretaties
De kwetsbaarheden omvatten onder andere de mogelijkheid voor niet-geauthenticeerde gebruikers om Denial of Service (DoS) condities te veroorzaken door het indienen van kwaadaardige JSON-verzoeken. Daarnaast konden niet-geauthenticeerde gebruikers zich aansluiten bij willekeurige organisaties door verzoekheaders te wijzigen, wat leidde tot ongeautoriseerde toegang tot organisatorische middelen. Geauthenticeerde gebruikers konden ook ongeautoriseerde toegang krijgen tot gevoelige tokens uit bepaalde logs, wat verdere exploitatie mogelijk maakte. Bovendien konden geauthenticeerde gebruikers met specifieke rechten een Denial of Service-conditie veroorzaken via HTTP-responsverwerking. Tot slot was er een risico op ongeautoriseerde toegang tot beveiligingsrapportinformatie in bepaalde configuraties. Deze kwetsbaarheden vereisten onmiddellijke aandacht van de leverancier om de integriteit en beschikbaarheid van de getroffen systemen te waarborgen.

Oplossingen
GitLab heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 6

  • High 7.7
    CVE-2024-9183

    Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 prior to 18.4.5, 18.5 prior to 18.5.3, and 18.6 prior to 18.6.1 that could have allowed an authenticated user to obtain credentials from higher-privileged users and perform action…

    GitLab GitLab Web / CMS
  • High 7.5
    CVE-2025-12571

    Allocation of Resources Without Limits or Throttling in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed an unauthenticated user to cause a Denial of Service condition by sending specifically crafted r…

    GitLab GitLab Web / CMS
  • Medium 6.5
    CVE-2025-12653

    Authentication Bypass by Spoofing in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that under specific conditions could have allowed an unauthenticated user to join arbitrary organizations by changing hea…

    GitLab GitLab Web / CMS
  • Medium 6.5
    CVE-2025-7449

    Allocation of Resources Without Limits or Throttling in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed an authenticated user with specific permissions to cause a denial of service condition through HTT…

    GitLab GitLab Web / CMS
  • Medium 4.3
    CVE-2025-6195

    Direct Request ('Forced Browsing') in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 13.7 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed an authenticated user to view information from security reports under certain configuration conditio…

    GitLab GitLab Web / CMS
  • Low 2.0
    CVE-2025-13611

    Insertion of Sensitive Information into Log File in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.2 before 18.5.5 and 18.6 before 18.6.3 that could have allowed an authenticated user with access to certain logs to obtain sensitive tokens under specific conditions.

    GitLab GitLab Web / CMS

Revision history

  1. #1.0.0

    Initiele versie

References

  • Reference
    https://about.gitlab.com/releases/2025/11/26/patch-release-gitlab-18-6-1-released/