MEDIUM
CVE-2025-5819
CVSS
5
Description
An issue has been discovered in GitLab CE/EE affecting all versions from 15.7 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users with developer access to obtain ID tokens for protected branches under certain circumstances.
Summary dbcve.org
Authenticated users with developer access to GitLab repositories could obtain ID tokens for protected branches under certain circumstances, representing a privilege escalation or authorization bypass issue in GitLab's branch protection mechanism.
Mitigation
Upgrade GitLab CE/EE to versions 18.0.6, 18.1.4, 18.2.2 or later to patch this authorization vulnerability affecting protected branch ID token issuance.
Weakness (CWE)
CWE-732
Incorrect Permission Assignment
EPSS Score
0.26%
Probability of exploitation in next 30 days
17.7th percentile
References
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.