CVE-2025-12704: GitLab EE Auth Bypass Vulnerability

CVE-2025-12704 Overview

GitLab has remediated an improper authorization vulnerability in GitLab Enterprise Edition (EE) that could allow an authenticated user to access Virtual Registry data in groups where they are not members. This authorization bypass occurs under certain conditions when the application fails to properly validate user membership before granting access to sensitive group resources.

Critical Impact

Authenticated users may gain unauthorized access to Virtual Registry data belonging to groups they are not members of, potentially exposing sensitive package and container registry information.

Affected Products

• GitLab EE versions 18.2 before 18.7.6
• GitLab EE versions 18.8 before 18.8.6
• GitLab EE versions 18.9 before 18.9.2

Discovery Timeline

• 2026-03-11 - CVE-2025-12704 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2025-12704

Vulnerability Analysis

This vulnerability is classified under CWE-862 (Missing Authorization), indicating that the GitLab EE application fails to perform proper authorization checks when handling requests to access Virtual Registry data. The flaw allows authenticated users to bypass group membership restrictions and view registry information from groups they should not have access to.

The vulnerability requires network access and an authenticated user account, with user interaction required for exploitation. The impact is limited to confidentiality, as attackers can only read unauthorized data without the ability to modify or delete registry contents.

Root Cause

The root cause stems from missing authorization validation in the Virtual Registry access control logic. Under certain conditions, GitLab EE does not properly verify that the requesting user is a member of the target group before serving Virtual Registry data. This improper authorization check (CWE-862) allows authenticated users to access resources outside their intended scope.

Attack Vector

The attack requires an authenticated GitLab user to craft requests targeting Virtual Registry endpoints for groups where they lack membership. The network-based attack vector means this can be exploited remotely by any authenticated user with knowledge of target group identifiers.

The exploitation scenario involves:

1. An attacker authenticates to the GitLab EE instance with valid credentials
2. The attacker identifies or enumerates group IDs containing Virtual Registry data
3. By crafting specific requests to the Virtual Registry API endpoints, the attacker bypasses group membership checks
4. The attacker gains read access to Virtual Registry data they should not be authorized to view

For detailed technical information, refer to the HackerOne Security Report #3389825 and the GitLab Work Item #579534.

Detection Methods for CVE-2025-12704

Indicators of Compromise

• Unusual API requests to Virtual Registry endpoints from users not belonging to target groups
• Access logs showing authenticated users querying registry data for multiple groups in rapid succession
• Audit events indicating Virtual Registry data access by non-member users

Detection Strategies

• Review GitLab audit logs for Virtual Registry access patterns from users accessing groups they are not members of
• Implement alerting on Virtual Registry API endpoints for requests that return data for groups where the requesting user lacks membership
• Monitor for enumeration attempts where users systematically query registry endpoints across multiple group IDs

Monitoring Recommendations

• Enable comprehensive audit logging for all Virtual Registry access events
• Configure alerts for anomalous access patterns to group-scoped resources
• Regularly review access logs for Virtual Registry endpoints to identify potential unauthorized access attempts

How to Mitigate CVE-2025-12704

Immediate Actions Required

• Upgrade GitLab EE to patched versions 18.7.6, 18.8.6, or 18.9.2 immediately
• Review audit logs for any evidence of unauthorized Virtual Registry access
• Assess sensitive data stored in Virtual Registries and evaluate potential exposure

Patch Information

GitLab has released security patches addressing this vulnerability in the following versions:

For complete patch details, see the GitLab Patch Release Announcement.

Workarounds

• Restrict Virtual Registry usage to trusted groups until patches can be applied
• Implement additional network-level access controls to limit which users can reach Virtual Registry endpoints
• Review and tighten group membership policies to minimize potential exposure

# Verify GitLab version after patching
gitlab-rake gitlab:env:info | grep "GitLab"

# Review recent Virtual Registry access in audit logs
gitlab-rails console -e production
# Then run: AuditEvent.where("details LIKE '%virtual_registry%'").order(created_at: :desc).limit(50)