CVE-2025-6171: GitLab Information Disclosure Vulnerability

CVE-2025-6171 is an information disclosure vulnerability in GitLab CE/EE that allows authenticated attackers with reporter access to view branch names and pipeline details via the packages API endpoint. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2025-6171 Overview

GitLab has patched an authorization flaw in GitLab Community Edition (CE) and Enterprise Edition (EE) that exposed repository metadata through the packages API. The vulnerability affects all versions from 13.2 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2. An authenticated attacker with Reporter access could query the packages API endpoint to view branch names and pipeline details even when repository access was explicitly disabled. This bypasses the project setting intended to hide source control metadata from lower-privilege members. The issue is tracked under CWE-862: Missing Authorization.

Critical Impact
Reporter-level users can enumerate branch names and pipeline metadata from projects where repository access has been disabled, undermining project confidentiality controls.

Affected Products

GitLab CE/EE versions 13.2 through 18.3.5
GitLab CE/EE versions 18.4 through 18.4.3
GitLab CE/EE versions 18.5 through 18.5.1

Discovery Timeline

2025-11-12 - GitLab releases patched versions 18.5.2, 18.4.4, and 18.3.6
2025-11-15 - CVE-2025-6171 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6171

Vulnerability Analysis

The vulnerability is a missing authorization check in the packages API endpoint of GitLab CE/EE. Projects can restrict repository visibility so that Reporter-role users cannot browse source, branches, or CI/CD pipeline details. The packages API did not consistently enforce this restriction. When a Reporter queried package metadata, the response included branch_name and pipeline details tied to the package build. This leaks internal branching conventions, release workflows, and pipeline identifiers that should remain hidden.

Exploitation requires only a valid authenticated session with Reporter permissions on the target project. The attack occurs over the network against the GitLab API, requires no user interaction, and has low complexity. Impact is limited to confidentiality; no integrity or availability effects are involved.

Root Cause

The packages API endpoint performed authorization based on package-level visibility rather than checking the project's repository access setting. This is a classic broken access control pattern where a secondary API returns primary-object metadata without re-evaluating the parent resource's access rules. See the GitLab Issue Discussion for the maintainers' technical write-up.

Attack Vector

An attacker with a Reporter role on any affected project issues an authenticated request to the packages API endpoint. The API returns package objects that embed branch_name and pipeline fields sourced from the repository. No repository read permission is validated before returning these fields. Refer to the HackerOne Report #3183740 for the original researcher submission. No public proof-of-concept exploit is available, and the vulnerability is not listed in CISA KEV.

Detection Methods for CVE-2025-6171

Indicators of Compromise

Unusual volume of GET requests from Reporter-role accounts to /api/v4/projects/:id/packages endpoints
API access from Reporter accounts to projects where repository access is disabled
Repeated packages API enumeration across multiple projects by the same user token

Detection Strategies

Audit GitLab production logs for packages API calls correlated with the requester's project role
Flag Reporter-role sessions that access packages endpoints on repository-restricted projects
Baseline normal packages API usage per user and alert on statistical outliers

Monitoring Recommendations

Enable GitLab audit events for API access and forward to a centralized log platform
Monitor personal access token and OAuth token usage against packages endpoints
Review historical logs from GitLab 13.2 onward for retrospective exposure assessment

How to Mitigate CVE-2025-6171

Immediate Actions Required

Upgrade GitLab CE/EE to version 18.5.2, 18.4.4, or 18.3.6 as applicable to your release track
Inventory projects that disable repository access but expose packages and prioritize their upgrade path
Review Reporter-role membership on sensitive projects and remove unnecessary access

Patch Information

GitLab addressed the issue in the November 12, 2025 patch release. See the GitLab Patch Release Announcement for release notes and upgrade instructions. Self-managed installations should follow the standard zero-downtime upgrade procedure.

Workarounds

Disable the Packages feature at the project or group level until the instance is patched
Restrict Reporter role assignments on projects where repository content is confidential
Enforce network-level access controls on the GitLab API where feasible

bash

# Verify installed GitLab version
sudo gitlab-rake gitlab:env:info | grep "GitLab information" -A 5

# Upgrade path for Omnibus GitLab (Debian/Ubuntu)
sudo apt-get update
sudo apt-get install gitlab-ee=18.5.2-ee.0

# Optional: disable Packages at the instance level via Admin Area
# Admin Area > Settings > Packages > uncheck "Enable Package Registry"