CVE-2025-4979 — Insufficient Granularity of Access Control in Gitlab

CWE-1220 — Insufficient Granularity of Access Control5 documents5 sources
Severity
7.5HIGHNVD
EPSS
0.1%
top 79.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab CE
Timeline
PublishedMay 22

Description

An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. An attacker may be able to reveal masked or hidden CI variables (that they did not author) in the WebUI, by simply creating their own variable and observing the HTTP response.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages5 packages

▶CVEListV5gitlab/gitlab17.11 — 17.11.3+1
▶NVDgitlab/gitlab17.11.0 — 17.11.3+2
▶debiandebian/gitlab
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
OSV
CVE-2025-4979: An issue has been discovered in GitLab CE/EE affecting all versions before 17↗2025-05-22
▶
GHSA
GHSA-9vrq-hh79-6v9m: An issue has been discovered in GitLab CE/EE affecting all versions before 17↗2025-05-22
▶

📋Vendor Advisories

2
GitLab
CVE-2025-4979: An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. An attacker may be a↗2025-05-22
▶
Debian
CVE-2025-4979: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions before 17.10...↗2025
▶