CVE-2025-7736

MediumCVSS 4.3/10Last modified Oct 19, 2026

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.9 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated attacker to bypass access control restrictions and view GitLab Pages content intended only for project members by authenticating through OAuth providers.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 17.9, < 18.3.6; >= 18.4, < 18.4.4; >= 18.5, < 18.5.2

References

https://about.gitlab.com/releases/2025/11/12/patch-release-gitlab-18-5-2-released/Release Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/556098Broken Link
https://hackerone.com/reports/3250156Permissions Required

Timeline

Published: Nov 15, 2025
Last modified: Oct 19, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-77378.6DoS Vulnerability in 10G iSCSI Interface of Hitachi Virtual Storage Platform. This issue affects Hitachi Virtual Storage Platform E990, E CVE-2025-77384.4A flaw was found in Ansible Automation Platform (AAP) where the Gateway API returns the client secret for certain GitHub Enterprise authenti CVE-2025-77395.4An issue has been discovered in GitLab CE/EE affecting all versions from 18.2 before 18.2.2 that, under certain conditions, could have allow CVE-2025-77408.8Default credentials vulnerability exists in SuprOS product. If exploited, this could allow an authenticated local attacker to use an admin a CVE-2025-77412.1Hardcoded Password Vulnerability have been found in CENTUM. Affected products contain a hardcoded password for the user account (PROG) used CVE-2025-77428.3An authentication vulnerability exists in the LG Innotek camera model LNV5110R firmware that allows a malicious actor to upload an HTTP POST CVE-2025-77439.6Cleartext Transmission of Sensitive Information vulnerability in Dolusoft Omaspot allows Interception, Privilege Escalation. This issue aff CVE-2025-77449.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dolusoft Omaspot allows SQL Injection.CVE-2025-77455.8Buffer Over-read vulnerability in ABB AC500 V2.This issue affects AC500 V2: through 2.5.2.CVE-2025-77465.3CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause an unvali CVE-2025-77478.8A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9. This affects the function fromWizardHandle of the file /goform CVE-2025-77483.5A vulnerability classified as problematic was found in ZCMS 3.6.0. This vulnerability affects unknown code of the component Create Article P