CVE-2025-8770

An issue has been discovered in GitLab EE affecting all versions from 18.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2 that could have allowed authenticated users with specific access to bypass merge request approval policies by manipulating approval rule identifiers...

CVE-2025-5819

An issue has been discovered in GitLab CE/EE affecting all versions from 15.7 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users with developer access to obtain ID tokens for protected branches under certain circumstances...

CVE-2025-2498

An improper access control in Gitlab EE affecting all versions from 12.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2 that under certain conditions could have allowed users to view assigned issues from restricted groups by bypassing IP restrictions...

CVE-2025-1477

An issue has been discovered in GitLab CE/EE affecting all versions from 8.14 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed an unauthenticated user to create a denial of service condition by sending specially crafted payloads to specific integration API endpoin...

UBUNTU-CVE-2025-2614

An issue has been discovered in GitLab CE/EE affecting all versions from 11.6 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed an authenticated user to cause a denial of service condition by creating specially crafted content that consumes excessive server resourc...

UBUNTU-CVE-2025-2498

An improper access control in Gitlab EE affecting all versions from 12.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2 that under certain conditions could have allowed users to view assigned issues from restricted groups by bypassing IP restrictions...

CVE-2024-10219 Incorrect Authorization in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 15.6 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that under certain conditions could have allowed authenticated users to bypass access controls and download private artifacts by accessing specific API endpoints...

CVE-2025-2498

CVE-2025-2498 concerns GitLab EE with an improper access control that could allow users to view assigned issues from restricted groups by bypassing IP restrictions. Affected versions are GitLab EE 12.0 through prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2. The connected document...

CVE-2025-2498

Removed by vendor...

CVE-2025-2498 Insufficient Granularity of Access Control in GitLab

An improper access control in Gitlab EE affecting all versions from 12.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2 that under certain conditions could have allowed users to view assigned issues from restricted groups by bypassing IP restrictions...

CVE-2025-5819

CVE-2025-5819 affects GitLab CE/EE versions 15.7–before 18.0.6, 18.1–before 18.1.4, and 18.2–before 18.2.2. The issue allows authenticated users with developer access to obtain ID tokens for protected branches under certain circumstances. The provided documents confirm the affected versions and t...

CVE-2025-6186

CVE-2025-6186 affects GitLab CE/EE: all versions from 18.1 before 18.1.4 and 18.2 before 18.2.2. The issue allows authenticated users to potentially take over accounts by injecting malicious HTML into work item names. Connected sources (OSV entries) confirm the same description and affected versi...

CVE-2025-7739

Removed by vendor...

CVE-2025-7739

GitLab CE/EE CVE-2025-7739 affects all versions 18.2 prior to 18.2.2. Under certain conditions, authenticated users could perform stored cross-site scripting by injecting malicious HTML into scoped label descriptions. Root cause described as a stored XSS vulnerability; exploitation status not det...

CVE-2025-7734

Removed by vendor...

CVE-2025-8770 Authorization Bypass Through User-Controlled Key in GitLab

An issue has been discovered in GitLab EE affecting all versions from 18.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2 that could have allowed authenticated users with specific access to bypass merge request approval policies by manipulating approval rule identifiers...

CVE-2025-8770

CVE-2025-8770 describes a vulnerability in GitLab EE where authenticated users with specific access could bypass merge request approval policies by manipulating approval rule identifiers. Affected versions are GitLab EE 18.0 up to before 18.0.6, 18.1 up to before 18.1.4, and 18.2 up to before 18....

CVE-2025-8770 Authorization Bypass Through User-Controlled Key in GitLab

An issue has been discovered in GitLab EE affecting all versions from 18.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2 that could have allowed authenticated users with specific access to bypass merge request approval policies by manipulating approval rule identifiers...

CVE-2025-8770

Removed by vendor...

CVE-2025-8770 Authorization Bypass Through User-Controlled Key in GitLab

An issue has been discovered in GitLab EE affecting all versions from 18.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2 that could have allowed authenticated users with specific access to bypass merge request approval policies by manipulating approval rule identifiers...