by Kastro
Paper/Archive/CVE-2025-7659

CVE-2025-7659

GitLab GitLab — Origin Validation Error in GitLab

EPSS 0.2%CVSS 9.1
critical.is priorityof 100
30
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 12.2.122 × 202.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an unauthenticated user to steal tokens and access private repositories by abusing incomplete validation in the Web IDE.

Affected

ProductAffectedFixed inSource
GitLab18.2 – < 18.6.618.6.6CNA
GitLab18.7 – < 18.7.418.7.4CNA
GitLab18.8 – < 18.8.418.8.4CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GitLab (CNA)8.0CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgitlab.com/gitlab-org/gitlab/-/issues/555440exploithackerone.com/reports/3234976refabout.gitlab.com/releases/2026/02/10/patch-release-gitlab-18-8-4-released