An issue has been discovered in GitLab CE/EE affecting all versions from 17.6 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2, that, under specific conditions, could have allowed unauthorized users to view confidential branch names by accessing project issues with related merge requests.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Gitlab |
|
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
Upgrade to version 16.X.X, 16.Y.Y or 16.Z.Z
Workaround
No workaround given by the vendor.
References
History
Sat, 15 Nov 2025 08:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An issue has been discovered in GitLab CE/EE affecting all versions from 17.6 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2, that, under specific conditions, could have allowed unauthorized users to view confidential branch names by accessing project issues with related merge requests. | |
| Title | Insertion of Sensitive Information Into Sent Data in GitLab | |
| First Time appeared |
Gitlab
Gitlab gitlab |
|
| Weaknesses | CWE-201 | |
| CPEs | cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Gitlab
Gitlab gitlab |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: GitLab
Published:
Updated: 2025-11-15T08:04:19.745Z
Reserved: 2025-07-02T01:02:14.407Z
Link: CVE-2025-7000
Vulnrichment
No data.
NVD
Status : Received
Published: 2025-11-15T08:15:46.487
Modified: 2025-11-15T08:15:46.487
Link: CVE-2025-7000
Redhat
No data.
OpenCVE Enrichment
No data.