Skip to content
OpenAdvisories
Medium WID-SEC-2025-2684 6 CVEs

GitLab: Mehrere Schwachstellen

Published Nov 26, 2025 · Updated Nov 26, 2025 · de-DE

Platform: Linux Platform: macOS Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um Benutzerrechte zu erlangen, einen Denial of Service herbeizuführen, Informationen offenzulegen oder Sicherheitsvorkehrungen zu umgehen.

Product

GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.

Vulnerabilities 6

  • High 7.7
    CVE-2024-9183

    Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 prior to 18.4.5, 18.5 prior to 18.5.3, and 18.6 prior to 18.6.1 that could have allowed an authenticated user to obtain credentials from higher-privileged users and perform action…

    GitLab GitLab Web / CMS
  • High 7.5
    CVE-2025-12571

    Allocation of Resources Without Limits or Throttling in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed an unauthenticated user to cause a Denial of Service condition by sending specifically crafted r…

    GitLab GitLab Web / CMS
  • Medium 6.5
    CVE-2025-12653

    Authentication Bypass by Spoofing in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that under specific conditions could have allowed an unauthenticated user to join arbitrary organizations by changing hea…

    GitLab GitLab Web / CMS
  • Medium 6.5
    CVE-2025-7449

    Allocation of Resources Without Limits or Throttling in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed an authenticated user with specific permissions to cause a denial of service condition through HTT…

    GitLab GitLab Web / CMS
  • Medium 4.3
    CVE-2025-6195

    Direct Request ('Forced Browsing') in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 13.7 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed an authenticated user to view information from security reports under certain configuration conditio…

    GitLab GitLab Web / CMS
  • Low 2.0
    CVE-2025-13611

    Insertion of Sensitive Information into Log File in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.2 before 18.5.5 and 18.6 before 18.6.3 that could have allowed an authenticated user with access to certain logs to obtain sensitive tokens under specific conditions.

    GitLab GitLab Web / CMS

Revision history

  1. #1

    Initiale Fassung

References