CVE-2025-13761

GitLab CVE-2025-13761 affects GitLab CE/EE versions prior to 18.6.3 and 18.7 prior to 18.7.1. An unauthenticated attacker could induce code execution in the context of an authenticated user’s browser by enticing the user to visit a crafted web page, effectively enabling browser-based arbitrary co...

CVE-2025-13761 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an unauthenticated user to execute arbitrary code in the context of an authenticated user's browser by convincing the legitimate user to visit a specially...

CVE-2025-13761 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an unauthenticated user to execute arbitrary code in the context of an authenticated user's browser by convincing the legitimate user to visit a specially...

CVE-2025-13781 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to modify instance-wide AI feature provider settings by exploiting missing authorization checks in GraphQL mutations...

CVE-2025-13781 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to modify instance-wide AI feature provider settings by exploiting missing authorization checks in GraphQL mutations...

CVE-2025-13781

GitLab EE was affected by a missing authorization check in GraphQL mutations that could let an authenticated user modify instance-wide AI feature provider settings. The issue impacted GitLab EE versions 18.5 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1. Remediation involved a patch r...

CVE-2025-13781 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to modify instance-wide AI feature provider settings by exploiting missing authorization checks in GraphQL mutations...

CVE-2020-7978

GitLab EE 12.6 and later through 12.7.2 allows Denial of Service...

CVE-2020-7969

GitLab EE 8.0 and later through 12.7.2 allows Information Disclosure...

CVE-2020-7972

GitLab EE 12.2 has Insecure Permissions issue 2 of 2...

CVE-2020-7976

GitLab EE 12.4 and later through 12.7.2 has Incorrect Access Control...

CVE-2020-7967

GitLab EE 8.0 through 12.7.2 has Insecure Permissions issue 1 of 2...

CVE-2020-7973

GitLab through 12.7.2 allows XSS...

CVE-2020-7968

GitLab EE 8.0 through 12.7.2 has Incorrect Access Control...

CVE-2020-7977

GitLab EE 8.8 and later through 12.7.2 has Insecure Permissions...

CVE-2020-7971

GitLab EE 11.0 and later through 12.7.2 allows XSS...

CVE-2020-7979

GitLab EE 8.9 and later through 12.7.2 has Insecure Permission...

CVE-2020-10086

GitLab 10.4 through 12.8.1 allows Directory Traversal. A particular endpoint was vulnerable to a directory traversal vulnerability, leading to arbitrary file read...

CVE-2020-10077

GitLab EE 3.0 through 12.8.1 allows SSRF. An internal investigation revealed that a particular deprecated service was creating a server side request forgery risk...

CVE-2020-10080

GitLab 8.3 through 12.8.1 allows Information Disclosure. It was possible for certain non-members to access the Contribution Analytics page of a private group...