CVE-2025-7736: Incorrect Authorization in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.9 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated attacker to bypass access control restrictions and view GitLab Pages content intended only for project members by authenticating through OAuth providers.
Other sources
GitLab has remediated an issue that could have allowed an authenticated user to bypass access control restrictions and view GitLab Pages content intended only for project members by authenticating through OAuth providers.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-7736?
CVE-2025-7736 is considered a critical vulnerability as it allows an authenticated attacker to bypass access controls.
How do I fix CVE-2025-7736?
To remediate CVE-2025-7736, upgrade GitLab to version 18.3.6, 18.4.4, or 18.5.2.
Which versions of GitLab are affected by CVE-2025-7736?
CVE-2025-7736 affects GitLab CE/EE versions from 17.9 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2.
What type of access does CVE-2025-7736 allow an attacker to gain?
CVE-2025-7736 allows the attacker to bypass access control restrictions and view protected GitLab Pages content.
Is there any workaround for CVE-2025-7736?
There are no documented workarounds for CVE-2025-7736; the recommended action is to upgrade to a fixed version.