Improper access control in GitLab Enterprise Edition and Gitlab Community Edition - CVE-2025-7736
Published: November 13, 2025
Vulnerability identifier: #VU118470
CSH Severity: Low
CVSS v4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-7736
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions in GitLab Pages. A remote user can bypass implemented security restrictions and view GitLab Pages content intended only for project members.
Affected software
GitLab Enterprise Edition
Gitlab Community Edition
Gitlab Community Edition
How to mitigate CVE-2025-7736
Install updates from vendor's website.
GitLab Enterprise Edition - addressed in versions 18.3.6, 18.4.4, 18.5.2
Gitlab Community Edition - addressed in versions 18.3.6, 18.4.4, 18.5.2
Gitlab Community Edition - addressed in versions 18.3.6, 18.4.4, 18.5.2