CVE-2025-7001: 
GitLab vulnerability analysis and mitigation

An issue has been discovered in GitLab CE/EE affecting all versions from 15.0 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that could have allowed privileged users to access certain resource_group information through the API which should have been unavailable (GitLab Release, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The issue is classified under CWE-1220 (Insufficient Granularity of Access Control). The vulnerability affects both Community Edition (CE) and Enterprise Edition (EE) versions of GitLab, with network-based attack vector, low attack complexity, and requires low privileges (GitLab Release, NVD).

The vulnerability allows privileged users to access certain resource_group information through the API that should have been restricted. The impact is limited to unauthorized information disclosure with no impact on system integrity or availability (GitLab Release).

GitLab has released patches in versions 18.2.1, 18.1.3, and 18.0.5 to address this vulnerability. GitLab.com is already running the patched version. It is strongly recommended that all self-managed GitLab installations be upgraded to one of these patched versions immediately (GitLab Release).