CVE-2025-6195: GitLab EE Information Disclosure Vulnerability

CVE-2025-6195 Overview

GitLab patched an information disclosure vulnerability in GitLab Enterprise Edition (EE) that allowed authenticated users to view data from security reports under specific configuration conditions. The flaw affects all versions from 13.7 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1. The issue is tracked under [CWE-425: Forced Browsing] and was disclosed through the HackerOne Report #3155693. GitLab addressed the issue in the GitLab Patch Release 18.6.1.

Critical Impact
An authenticated low-privileged user can access confidential security report information intended for restricted roles, exposing vulnerability findings that may aid further attacks.

Affected Products

GitLab Enterprise Edition versions 13.7 through 18.4.4
GitLab Enterprise Edition versions 18.5 through 18.5.2
GitLab Enterprise Edition version 18.6.0

Discovery Timeline

2025-11-26 - GitLab releases patch version 18.6.1 addressing the issue
2025-11-26 - CVE-2025-6195 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6195

Vulnerability Analysis

The vulnerability resides in GitLab EE's authorization logic governing access to security reports. Under certain configuration conditions, an authenticated user without sufficient privileges can retrieve data from security scan outputs. Security reports typically contain sensitive findings from Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), dependency scanning, and container scanning workflows.

Exposed data may include unpatched vulnerabilities, affected file paths, dependency versions, and remediation guidance. This information provides attackers with a roadmap of exploitable weaknesses in the target codebase or infrastructure. The issue was disclosed through GitLab's bug bounty program, as detailed in GitLab Issue #549937 Discussion.

Root Cause

The flaw is classified as [CWE-425: Forced Browsing]. The application fails to enforce proper authorization checks when a user requests security report resources through predictable endpoints. Users can access these resources by navigating directly to the underlying URLs, bypassing intended role-based restrictions.

Attack Vector

Exploitation requires network access to a GitLab EE instance and a valid authenticated account with low privileges. The attacker sends crafted HTTP requests to security report endpoints on projects where they lack the intended permission level. No user interaction is required, and the attack complexity is low. Impact is limited to information confidentiality; integrity and availability are not affected.

Refer to the GitLab Patch Release 18.6.1 advisory for detailed technical context.

Detection Methods for CVE-2025-6195

Indicators of Compromise

Unexpected HTTP requests from low-privileged user accounts to /security/vulnerabilities, /security/dashboard, or project-scoped security report endpoints.
API calls to GraphQL vulnerability queries originating from accounts that should not have Developer or higher access.
Anomalous spikes in security report downloads by individual user sessions.

Detection Strategies

Review GitLab production and audit logs for repeated requests to security-report resources from accounts assigned Guest or Reporter roles.
Correlate authentication events with access to sensitive project namespaces to identify enumeration patterns.
Baseline normal security report access per role and alert on deviations.

Monitoring Recommendations

Forward GitLab application, audit, and access logs to a centralized SIEM for retention and analysis.
Enable GitLab audit events for project membership changes and security dashboard access.
Monitor for successful HTTP 200 responses to security endpoints from accounts that historically received HTTP 403.

How to Mitigate CVE-2025-6195

Immediate Actions Required

Upgrade GitLab EE to version 18.4.5, 18.5.3, or 18.6.1 or later depending on your current release branch.
Audit project membership and role assignments to confirm least-privilege access to repositories containing sensitive security reports.
Review historical access logs for evidence of unauthorized security report retrieval prior to patching.

Patch Information

GitLab released the fix in the GitLab Patch Release 18.6.1 on November 26, 2025. Corresponding backports are available in versions 18.4.5 and 18.5.3. GitLab recommends upgrading self-managed instances immediately; GitLab.com has already been patched.

Workarounds

No official workaround exists; upgrading to a fixed version is the only supported remediation.
As a temporary risk reduction measure, restrict project membership and remove unnecessary Guest or Reporter accounts on projects containing sensitive security scan data.
Disable public visibility on affected projects until patching is complete.

bash

# Upgrade GitLab EE on Debian/Ubuntu to a fixed release
sudo apt-get update
sudo apt-get install gitlab-ee=18.6.1-ee.0

# Verify installed version
sudo gitlab-rake gitlab:env:info | grep "GitLab information"