{"id":"CVE-2025-5982","aliases":["BIT-gitlab-2025-5982","EUVD-2025-18195","GHSA-4m4w-7ph3-mcfg"],"status":"published","title":"Insufficient Granularity of Access Control in GitLab","description":"An issue has been discovered in GitLab EE affecting all versions from 12.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Under certain conditions users could bypass IP access restrictions and view sensitive information.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00313,"percentile":0.24472,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1220"],"published":"2025-06-12T16:27:56Z","modified":"2026-10-30T10:47:16Z","fixes":[{"ecosystem":"Bitnami","package":"gitlab","fixed_in":["18.0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"gitlab","ranges":[{"type":"SEMVER","events":[{"introduced":"12.0.0"},{"fixed":"18.0.2"}]}]}],"products":[{"vendor":"gitlab","product":"gitlab"}],"references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/514456","tags":["issue-tracking","permissions-required","Broken Link","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-5982","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-4m4w-7ph3-mcfg"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/5xxx/CVE-2025-5982.json","tags":["advisory"]},{"url":"git://git@gitlab.com:gitlab-org/gitlab.git","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-5982","title":"Insufficient Granularity of Access Control in GitLab","description":"An issue has been discovered in GitLab EE affecting all versions from 12.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Under certain conditions users could bypass IP access restrictions and view sensitive information.","status":"published","published":"2025-06-12T16:27:56.7Z","modified":"2025-06-12T17:29:27.471Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-1220"],"updated_at":"2026-11-02T14:32:29.97618Z"}],"euvd":[{"id":"EUVD-2025-18195","description":"An issue has been discovered in GitLab EE affecting all versions from 12.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Under certain conditions users could bypass IP access restrictions and view sensitive information.","status":"published","published":"2025-06-12T16:27:56Z","modified":"2025-06-12T17:29:27Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T20:32:24.065864Z"}],"ghsa":[{"id":"GHSA-4m4w-7ph3-mcfg","title":"An issue has been discovered in GitLab EE affecting all versions from 12.0 before 17.10.8, 17.11...","description":"An issue has been discovered in GitLab EE affecting all versions from 12.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Under certain conditions users could bypass IP access restrictions and view sensitive information.","status":"published","published":"2025-06-12T18:31:48Z","modified":"2025-06-12T18:31:53Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-1220"],"updated_at":"2026-11-02T15:02:42.831943Z"}],"nvd":[{"id":"CVE-2025-5982","description":"An issue has been discovered in GitLab EE affecting all versions from 12.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Under certain conditions users could bypass IP access restrictions and view sensitive information.","status":"published","published":"2025-06-12T17:15:29.44Z","modified":"2026-06-17T09:49:09.047Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-1220"],"updated_at":"2026-11-02T14:11:11.789448Z"}],"osv":[{"id":"CVE-2025-5982","title":"Insufficient Granularity of Access Control in GitLab","description":"An issue has been discovered in GitLab EE affecting all versions from 12.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Under certain conditions users could bypass IP access restrictions and view sensitive information.","status":"published","published":"2025-06-12T16:27:56.7Z","modified":"2026-10-30T10:47:16.50186195Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-1220"],"updated_at":"2026-11-02T15:44:51.516975Z"},{"id":"BIT-gitlab-2025-5982","title":"Insufficient Granularity of Access Control in GitLab","description":"An issue has been discovered in GitLab EE affecting all versions from 12.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Under certain conditions users could bypass IP access restrictions and view sensitive information.","status":"published","published":"2025-06-14T06:15:34.466Z","modified":"2025-08-13T06:08:53.695Z","updated_at":"2026-11-02T15:28:30.70064Z"}]}}