CVE-2025-1042

MEDIUM

GitLab EE <17.6.5-17.8.2 - Info Disclosure

Title source: llm

Description

An insecure direct object reference vulnerability in GitLab EE affecting all versions from 15.7 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to view repositories in an unauthorized way.

References (2)

[Broken Link] https://gitlab.com/gitlab-org/gitlab/-/issues/50849943

[Permissions Required] https://hackerone.com/reports/2886976

Scores

CVSS v3 4.9

EPSS 0.0006

EPSS Percentile 17.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Classification

CWE

CWE-552

Status published

Affected Products (1)

gitlab/gitlab < 17.6.5

Timeline

Published Feb 12, 2025

Tracked Since Feb 18, 2026