CVE-2025-12704: 
GitLab vulnerability analysis and mitigation

CVE-2025-12704 is an incorrect authorization vulnerability in GitLab Enterprise Edition (EE) affecting the Virtual Registry feature. It allows authenticated users to access Virtual Registry data belonging to groups they are not members of due to improper authorization checks under certain conditions. The vulnerability affects GitLab EE versions 18.2 through 18.7.5, 18.8.0 through 18.8.5, and 18.9.0 through 18.9.1. It was disclosed and patched on March 11, 2026, with a CVSS v3.1 base score of 3.5–4.3 (Low/Medium) (GitLab Advisory, Red Hat CVE).

The root cause is classified as CWE-862 (Missing Authorization), where the Virtual Registry access control logic fails to properly verify group membership under certain conditions (Red Hat CVE). An authenticated, low-privileged attacker can exploit this over the network without user interaction by making requests to Virtual Registry endpoints associated with groups they do not belong to. The vulnerability was reported by researcher "mateuszek" through GitLab's HackerOne bug bounty program, and the underlying issue is tracked internally at GitLab work item 579534 (GitLab Advisory).

Successful exploitation results in unauthorized read access to Virtual Registry data in groups where the attacker is not a member, constituting a confidentiality breach. The impact is limited to information disclosure — there is no integrity or availability impact. Sensitive registry metadata or artifacts stored in affected groups could be exposed to unauthorized authenticated users within the same GitLab instance (GitLab Advisory, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Red Hat CVE). The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

GitLab has released patched versions addressing this vulnerability: upgrade to GitLab EE 18.7.6 (for versions 18.2.x–18.7.x), 18.8.6 (for versions 18.8.x), or 18.9.2 (for versions 18.9.x). GitLab.com and GitLab Dedicated customers are not affected and do not need to take action. Self-managed GitLab EE administrators should upgrade immediately; no configuration-based workaround has been published (GitLab Advisory). As a precautionary measure, administrators should review Virtual Registry access logs for any anomalous cross-group access during the vulnerability window (from GitLab EE 18.2 onward).