CVE-2025-12555

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that, under certain conditions, could have allowed an authenticated user to access previous pipeline job information on projects with repository and CI/CD disabled due to improper authorization checks.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 15.1, < 18.7.6; >= 18.8, < 18.8.6; >= 18.9, < 18.9.2

References

https://about.gitlab.com/releases/2026/03/11/patch-release-gitlab-18-9-2-released/Release Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/work_items/579126Broken Link
https://hackerone.com/reports/3354642Permissions Required

Timeline

Published: Mar 11, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-125568.8An argument injection vulnerability exists in the affected product that could allow an attacker to execute arbitrary code within the context CVE-2025-125584.3The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and CVE-2025-125594.3Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to sanitize team email addresses to be CVE-2025-125604.3The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to,CVE-2025-125627.5GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 t CVE-2025-125634.3The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to limited file upload due to an incorrect capability CVE-2025-125694.7The Guest posting / Frontend Posting / Front Editor WordPress plugin before 5.0.0 does not validate a parameter before redirecting the user CVE-2025-12577.5An issue was discovered in GitLab EE affecting all versions starting with 12.3 before 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2 CVE-2025-125707.2The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and CVE-2025-125717.5GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 t CVE-2025-125736.5The Bookingor WordPress plugin through 1.0.12 exposes authenticated AJAX actions without capability or nonce checks, allowing low-privilege CVE-2025-125744.3The Listar – Directory Listing & Classifieds WordPress Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missi