Improper authentication in GitLab Enterprise Edition and Gitlab Community Edition - CVE-2025-12653
Published: November 26, 2025
Vulnerability identifier: #VU118792
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-12653
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to an error in account registration feature. A remote non-authenticated attacker can bypass authentication process and join any organization during registration by manipulating certain HTTP headers.
Affected software
GitLab Enterprise Edition
Gitlab Community Edition
Gitlab Community Edition
How to mitigate CVE-2025-12653
Install updates from vendor's website.
GitLab Enterprise Edition - addressed in versions 18.4.5, 18.5.3, 18.6.1
Gitlab Community Edition - addressed in versions 18.4.5, 18.5.3, 18.6.1
Gitlab Community Edition - addressed in versions 18.4.5, 18.5.3, 18.6.1