CVE-2025-13874 MEDIUM

CVE-2025-13874: Authorization Bypass Through User-Controlled Key in GitLab

Vendor Gitlab

Product GitLab

Weakness CWE-639 · IDOR

Published May 14, 2026

Last update May 14, 2026

View on NVD All CVEs

CVSS base score

4.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality Low

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with Guest permissions to view issues in projects they were not authorized to access.

Key dates

02Disclosure timeline

May 14, 2026 CVE published

May 14, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-13874 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/639.html

Identifiers

CVE CVE-2025-13874

CWE CWE-639

CVSS 4.3 / MEDIUM

Affected versions

Vendor Gitlab

Product GitLab

Affected ≥ 15.1 and < 18.9.7

Vendor Gitlab

Product GitLab

Affected ≥ 18.10 and < 18.10.6

Vendor Gitlab

Product GitLab

Affected ≥ 18.11 and < 18.11.3