CVE-2025-12704

LOW

GitLab EE 18.2-18.9.2 - Auth Bypass

Title source: llm

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to access Virtual Registry data in groups where they are not members due to improper authorization under certain conditions.

References (3)

[Release Notes] https://about.gitlab.com/releases/2026/03/11/patch-release-gitlab-18-9-2-released/

[Various Sources] https://gitlab.com/gitlab-org/gitlab/-/work_items/579534

[Third Party Advisory] https://hackerone.com/reports/3389825

Scores

CVSS v3 3.5

EPSS 0.0001

EPSS Percentile 3.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Details

CWE

CWE-862

Status published

Products (1)

gitlab/gitlab 18.2.0 - 18.7.6 (2 CPE variants)

Published Mar 11, 2026

Tracked Since Mar 11, 2026