CVE-2025-9825 — Missing Authorization in Gitlab

CWE-862 — Missing Authorization5 documents5 sources
Severity
6.5MEDIUMNVD
EPSS
0.0%
top 99.44%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab CE
Timeline
PublishedNov 21

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 to 18.2.8, 18.3 before 18.3.4, and 18.4 before 18.4.2 that could have allowed authenticated users without project membership to view sensitive manual CI/CD variables by querying the GraphQL API.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages5 packages

▶CVEListV5gitlab/gitlab13.7 — 18.2.8+2
▶NVDgitlab/gitlab13.7.0 — 18.2.8+2
▶debiandebian/gitlab
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
OSV
CVE-2025-9825: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13↗2025-11-21
▶
GHSA
GHSA-x8pr-qx2m-cr7g: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13↗2025-11-21
▶

📋Vendor Advisories

2
GitLab
CVE-2025-9825: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 to 18.2.8, 18.3 before 18.3.4, and 18.4 before 18.4.2 that could have↗2025-11-21
▶
Debian
CVE-2025-9825: gitlab - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 ...↗2025
▶