CVE-2025-0652

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-0652
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-0652.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-0652
Aliases
Downstream
Published
2025-03-13T05:55:59.744Z
Modified
2026-04-10T05:20:18.969897Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Incorrect Authorization in GitLab
Details

An issue has been discovered in GitLab EE/CE affecting all versions starting from 16.9 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2 could allow unauthorized users to access confidential information intended for internal use only.

Database specific 
{
    "cna_assigner": "GitLab",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/0xxx/CVE-2025-0652.json",
    "cwe_ids": [
        "CWE-863"
    ]
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
76326ae8b898b38c8217ad037ed7122be00e62f0
Fixed
14925e89dd8fcbadc4624ab451d64238cc651365
Database specific 
{
    "versions": [
        {
            "introduced": "16.9"
        },
        {
            "fixed": "17.7.7"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
f03594b9e09b648c839e9c008286a24c93c82373
Fixed
d7f0517433cc803ed10f8fed5b6b667d66f7a296
Database specific 
{
    "versions": [
        {
            "introduced": "17.8"
        },
        {
            "fixed": "17.8.5"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
f5041566b342c2f30a8d63b8117272c454e18410
Fixed
56dedd4cf9e7ce144b36c34ed45aa57355859659
Database specific 
{
    "versions": [
        {
            "introduced": "17.9"
        },
        {
            "fixed": "17.9.2"
        }
    ]
}

Affected versions

v17.*
v17.8.0-ee
v17.8.3-ee
v17.9.0-ee

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-0652.json"