CVE-2025-2615
Medium · 4.3CVSS
4.3
EPSS
0.3%
Published
Nov 15, 2025
CISA due date
—
The record
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.7 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2, that could have allowed a blocked user to access sensitive information by establishing GraphQL subscriptions through WebSocket connections.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Bitnami | gitlab | 16.7.0 | 18.3.6 |
| Chainguard | gitlab-docker-machine-18.4 | 0 | 18.4.0-r2 |
| Chainguard | gitlab-docker-machine-18.5 | 0 | 18.5.0-r1 |
| Chainguard | gitlab-docker-machine-fips-18.4 | 0 | 18.4.0-r2 |
| Chainguard | gitlab-docker-machine-fips-18.5 | 0 | 18.5.0-r1 |
| Chainguard | gitlab-rails-ce-18.1 | 0 | 18.1.6-r1 |
| Chainguard | gitlab-rails-ce-18.2 | 0 | 18.2.8-r1 |
| Chainguard | gitlab-rails-ce-assets-18.1 | 0 | 18.1.6-r1 |
| Chainguard | gitlab-rails-ce-assets-18.2 | 0 | 18.2.8-r1 |
| Chainguard | gitlab-rails-ce-assets-fips-18.1 | 0 | 18.1.6-r2 |
| Chainguard | gitlab-rails-ce-assets-fips-18.2 | 0 | 18.2.8-r2 |
| Chainguard | gitlab-rails-ce-doc-18.1 | 0 | 18.1.6-r1 |
| Chainguard | gitlab-rails-ce-doc-18.2 | 0 | 18.2.8-r1 |
| Chainguard | gitlab-rails-ce-doc-fips-18.1 | 0 | 18.1.6-r2 |
| Chainguard | gitlab-rails-ce-doc-fips-18.2 | 0 | 18.2.8-r2 |
| Chainguard | gitlab-rails-ce-fips-18.1 | 0 | 18.1.6-r2 |
| Chainguard | gitlab-rails-ce-fips-18.2 | 0 | 18.2.8-r2 |
| Chainguard | gitlab-runner-18.4 | 0 | 18.4.0-r2 |
| Chainguard | gitlab-runner-18.5 | 0 | 18.5.0-r1 |
| Chainguard | gitlab-runner-fips-18.4 | 0 | 18.4.0-r2 |
| Chainguard | gitlab-runner-fips-18.5 | 0 | 18.5.0-r1 |
| Chainguard | gitlab-runner-helper-18.4 | 0 | 18.4.0-r2 |
| Chainguard | gitlab-runner-helper-18.5 | 0 | 18.5.0-r1 |
| Chainguard | gitlab-runner-helper-compat-18.4 | 0 | 18.4.0-r2 |
| Chainguard | gitlab-runner-helper-compat-18.5 | 0 | 18.5.0-r1 |
| Chainguard | gitlab-runner-helper-compat-fips-18.4 | 0 | 18.4.0-r2 |
| Chainguard | gitlab-runner-helper-compat-fips-18.5 | 0 | 18.5.0-r1 |
| Chainguard | gitlab-runner-helper-fips-18.4 | 0 | 18.4.0-r2 |
| Chainguard | gitlab-runner-helper-fips-18.5 | 0 | 18.5.0-r1 |
| Chainguard | gitlab-runner-helper-oci-entrypoint-18.4 | 0 | 18.4.0-r2 |
| Chainguard | gitlab-runner-helper-oci-entrypoint-18.5 | 0 | 18.5.0-r1 |
| Chainguard | gitlab-runner-helper-oci-entrypoint-fips-18.4 | 0 | 18.4.0-r2 |
| Chainguard | gitlab-runner-helper-oci-entrypoint-fips-18.5 | 0 | 18.5.0-r1 |
| Chainguard | gitlab-runner-oci-entrypoint-18.4 | 0 | 18.4.0-r2 |
| Chainguard | gitlab-runner-oci-entrypoint-18.5 | 0 | 18.5.0-r1 |
| Chainguard | gitlab-runner-oci-entrypoint-fips-18.4 | 0 | 18.4.0-r2 |
| Chainguard | gitlab-runner-oci-entrypoint-fips-18.5 | 0 | 18.5.0-r1 |
| Chainguard | gitlab-workhorse-ce-18.1 | 0 | 18.1.6-r2 |
| Chainguard | gitlab-workhorse-ce-18.2 | 0 | 18.2.8-r2 |
| Chainguard | gitlab-workhorse-ce-fips-18.1 | 0 | 18.1.6-r3 |
| Chainguard | gitlab-workhorse-ce-fips-18.2 | 0 | 18.2.8-r2 |
| Wolfi | gitlab-docker-machine-18.4 | 0 | 18.4.0-r2 |
| Wolfi | gitlab-docker-machine-18.5 | 0 | 18.5.0-r1 |
| Wolfi | gitlab-runner-18.4 | 0 | 18.4.0-r2 |
| Wolfi | gitlab-runner-18.5 | 0 | 18.5.0-r1 |
| Wolfi | gitlab-runner-helper-18.4 | 0 | 18.4.0-r2 |
| Wolfi | gitlab-runner-helper-18.5 | 0 | 18.5.0-r1 |
| Wolfi | gitlab-runner-helper-compat-18.4 | 0 | 18.4.0-r2 |
| Wolfi | gitlab-runner-helper-compat-18.5 | 0 | 18.5.0-r1 |
| Wolfi | gitlab-runner-helper-oci-entrypoint-18.4 | 0 | 18.4.0-r2 |
| Wolfi | gitlab-runner-helper-oci-entrypoint-18.5 | 0 | 18.5.0-r1 |
| Wolfi | gitlab-runner-oci-entrypoint-18.4 | 0 | 18.4.0-r2 |
| Wolfi | gitlab-runner-oci-entrypoint-18.5 | 0 | 18.5.0-r1 |
Related vulnerabilities
- CVE-2026-1751 A vulnerability has been discovered in GitLab CE/EE affecting all versions starting with… Also affects gitlab
- CVE-2025-3950 Exposure of Private Personal Information to an Unauthorized Actor in GitLab Also affects gitlab
- CVE-2025-9222 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in… Also affects gitlab
- CVE-2025-10569 Allocation of Resources Without Limits or Throttling in GitLab Also affects gitlab
- CVE-2025-11246 Insufficient Granularity of Access Control in GitLab Also affects gitlab
- CVE-2025-13772 Missing Authorization in GitLab Also affects gitlab
- CVE-2025-13761 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in… Also affects gitlab
- CVE-2025-13781 Missing Authorization in GitLab Also affects gitlab