CVE-2025-6769 MEDIUM

CVE-2025-6769: Exposure of Sensitive System Information to an Unauthorized Control Sphere in GitLab

Vendor Gitlab

Product GitLab

Weakness CWE-497

Published September 12, 2025

Last update September 12, 2025

View on NVD All CVEs

CVSS base score

4.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality Low

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

An issue has been discovered in GitLab CE/EE affecting all versions from 15.1 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed authenticated users to view administrator-only maintenance notes by accessing runner details through specific interfaces.

Key dates

02Disclosure timeline

September 12, 2025 CVE published

September 12, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-6769 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/497.html

Identifiers

CVE CVE-2025-6769

CWE CWE-497

CVSS 4.3 / MEDIUM

Affected versions

Vendor Gitlab

Product GitLab

Affected ≥ 15.1 and < 18.1.6

Vendor Gitlab

Product GitLab

Affected ≥ 18.2 and < 18.2.6

Vendor Gitlab

Product GitLab

Affected ≥ 18.3 and < 18.3.2