GitLab has remediated an issue in GitLab EE affecting all versions from 13.7 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed an authenticated user to view information from security reports under certain configuration conditions.
References
| Link | Resource |
|---|---|
| https://about.gitlab.com/releases/2025/11/26/patch-release-gitlab-18-6-1-released/ | |
| https://gitlab.com/gitlab-org/gitlab/-/issues/549937 | Broken Link |
| https://hackerone.com/reports/3155693 | Permissions Required |
Configurations
Configuration 1 (hide)
|
History
10 Dec 2025, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
03 Dec 2025, 15:21
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Gitlab
Gitlab gitlab |
|
| References | () https://gitlab.com/gitlab-org/gitlab/-/issues/549937 - Broken Link | |
| References | () https://hackerone.com/reports/3155693 - Permissions Required | |
| CPE | cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* cpe:2.3:a:gitlab:gitlab:18.6.0:*:*:*:enterprise:*:*:* |
26 Nov 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-26 20:15
Updated : 2025-12-10 23:15
NVD link : CVE-2025-6195
Mitre link : CVE-2025-6195
CVE.ORG link : CVE-2025-6195
JSON object : View
Products Affected
gitlab
- gitlab
CWE
CWE-425
Direct Request ('Forced Browsing')