CVE-2025-12555

MEDIUM

GitLab CE/EE 15.1-18.7.5/18.8-18.8.5/18.9-18.9.1 - Info Disclosure

Title source: llm
STIX 2.1

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that, under certain conditions, could have allowed an authenticated user to access previous pipeline job information on projects with repository and CI/CD disabled due to improper authorization checks.

References (3)

Core 3
Core References
Third Party Advisory technical-description exploit permissions-required
https://hackerone.com/reports/3354642

Scores

CVSS v3 4.3
EPSS 0.0002
EPSS Percentile 5.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-863
Status published
Products (1)
gitlab/gitlab 15.1.0 - 18.7.6 (2 CPE variants)
Published Mar 11, 2026
Tracked Since Mar 12, 2026