Direct Request (‘Forced Browsing’) in GitLab_CVE-2025-6195

4.3 / 10

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 13.7 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed an authenticated user to view information from security reports under certain configuration conditions.

Basic Information

ID CVE-2025-6195

Source GitLab

Published Nov 26, 2025 at 19:46

Affected Product

Vendor GitLab

Product GitLab

Version 13.7

Affected Versions GitLab GitLab 13.7
GitLab GitLab 18.5
GitLab GitLab 18.6

CWE Classification

CWE-425

References

{
    "lastseen": "",
    "description": "GitLab has remediated an issue in GitLab EE affecting all versions from 13.7 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed an authenticated user to view information from security reports under certain configuration conditions.",
    "published": "2025-11-26T19:46:42.649Z",
    "modified": "2025-11-26T19:46:42.649Z",
    "type": "cve",
    "title": "Direct Request ('Forced Browsing') in GitLab",
    "source": "GitLab",
    "references": "https://gitlab.com/gitlab-org/gitlab/-/issues/549937\nhttps://hackerone.com/reports/3155693",
    "id": "CVE-2025-6195",
    "bulletinFamily": "",
    "cwe": [
        "CWE-425"
    ],
    "cvelist": null,
    "sourceData": "GitLab GitLab 13.7\nGitLab GitLab 18.5\nGitLab GitLab 18.6",
    "sourceHref": "",
    "cvss": {
        "score": 4.3,
        "severity": "MEDIUM",
        "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "GitLab",
    "version": "13.7",
    "vendor": "GitLab",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}