MEDIUM

CVE-2025-12653

Gitlab GitLab 2025-11-26 CVSS v3.1

CVSS

6.5

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that under specific conditions could have allowed an unauthenticated user to join arbitrary organizations by changing headers on some requests.

Summary dbcve.org

GitLab CE/EE versions prior to 18.4.5, 18.5.3, and 18.6.1 contain an authentication bypass vulnerability allowing unauthenticated users to join arbitrary organizations by manipulating HTTP headers on certain endpoints.

Mitigation

Upgrade GitLab to version 18.4.5, 18.5.3, or 18.6.1 or later. Prior to upgrading, ensure backups are in place and plan appropriate maintenance window.

Weakness (CWE)

CWE-290

EPSS Score

0.29%

Probability of exploitation in next 30 days

21.7th percentile

References

https://about.gitlab.com/releases/2025/11/26/patch-release-gitlab-18-6-1-released/ https://gitlab.com/gitlab-org/gitlab/-/issues/579372 Broken Link https://hackerone.com/reports/3370245 Permissions Required

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE