An issue has been discovered in GitLab CE/EE affecting all versions from 15.7 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2 that could have allowed authenticated users with developer access to obtain ID tokens for protected branches under certain circumstances.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://gitlab.com/gitlab-org/gitlab/-/issues/548165 | Broken Link |
| https://hackerone.com/reports/3137660 | Permissions Required |
Configurations
Configuration 1 (hide)
|
History
15 Aug 2025, 16:31
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://hackerone.com/reports/3137660 - Permissions Required | |
| References | () https://gitlab.com/gitlab-org/gitlab/-/issues/548165 - Broken Link | |
| CPE | cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* |
|
| First Time |
Gitlab gitlab
Gitlab |
13 Aug 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-08-13 18:15
Updated : 2025-08-15 16:31
NVD link : CVE-2025-5819
Mitre link : CVE-2025-5819
JSON object : View
Products Affected
gitlab
- gitlab
CWE
CWE-732
Incorrect Permission Assignment for Critical Resource