CVE-2025-12704CWE-862

Missing Authorization in GitLab

Low · published March 11, 2026

CVSS v3.1
3.5
EPSS
0%
Percentile
17.1
In the wild
Unconfirmed
What it is

GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to access Virtual Registry data in groups where they are not members due to improper authorization under certain conditions.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00262 · 17.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-03-11T16:05Z
EPSS history
Timeline
  • 11 MAR 16:05Z
    Missing Authorization in GitLab
    cvelistv5