Overview
CVE-2025-7736 is a security vulnerability identified in GitLab CE/EE affecting versions 17.9 through 18.5. Specifically, it impacts versions before 18.3.6, 18.4.4, and 18.5.2. This vulnerability could allow an authenticated attacker to bypass access control restrictions and view GitLab Pages content that was intended only for project members. This bypass is possible by authenticating through OAuth providers.
Technical Details
The vulnerability stems from an issue in how GitLab handles access control checks in conjunction with OAuth authentication for GitLab Pages. An attacker, already authenticated to GitLab via an OAuth provider, could potentially craft requests to access GitLab Pages content associated with projects where they are not explicitly authorized as members. This bypass circumvents the intended access controls, potentially exposing sensitive information.
CVSS Analysis
- CVSS Score: 3.1 (Low)
A CVSS score of 3.1 indicates a low-severity vulnerability. While exploitation is possible, the impact is limited. Specifically, the scope is unchanged (the vulnerability exists within GitLab), and the confidentiality impact is considered low. Access requires authentication, and no integrity or availability impacts are identified in the reported CVSS calculation.
Possible Impact
The successful exploitation of CVE-2025-7736 could allow an authenticated attacker to view GitLab Pages content that should be restricted to project members only. This could potentially expose sensitive data contained within those pages, leading to information disclosure. Given the low severity rating, the impact is likely limited to information leakage, as opposed to allowing for code execution or data modification.
Mitigation / Patch Steps
GitLab has released patches to address this vulnerability. It is strongly recommended that all GitLab instances running affected versions be upgraded to one of the following or a later version:
- Upgrade to version 18.3.6 or later if you are on the 18.3.x series.
- Upgrade to version 18.4.4 or later if you are on the 18.4.x series.
- Upgrade to version 18.5.2 or later if you are on the 18.5.x series.
Refer to the official GitLab release notes for detailed upgrade instructions.
