What is the CVSS score of CVE-2025-13874?

CVE-2025-13874 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2025-13874?

Yes, a patch is available for CVE-2025-13874. Update the affected software to the latest version immediately.

GitLab CE/EE CVE-2025-13874

EUVD-2025-209834 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-14 cve@gitlab.com

GHSA-576j-7qww-f874

Authentication Bypass Gitlab

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:25 vuln.today

Patch available

May 14, 2026 - 07:01 EUVD

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with Guest permissions to view issues in projects they were not authorized to access.

AnalysisAI

Unauthorized issue disclosure in GitLab CE/EE exposes confidential project data to authenticated Guest-level users who lack explicit project membership. By exploiting an object-level authorization flaw (CWE-639), a Guest user can retrieve issues belonging to projects they have no sanctioned access to, bypassing GitLab's project-level visibility controls. No public exploit exists and EPSS sits at 0.01%, but the broad version range - spanning GitLab 15.1 all the way through 18.11.2 - means a large install base requires patching, and the confidentiality risk is real for organizations using issues to track sensitive engineering or security work.

Technical ContextAI

The vulnerability is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), a class of flaw where an application uses a caller-supplied identifier - such as an issue ID or work item reference - to fetch an object without independently verifying that the requesting user holds the necessary permission on the parent resource (the project). GitLab's issue system allows cross-project issue references and direct API/URL access to work items; the access control check that should gate issue retrieval behind project membership failed to enforce authorization boundaries for Guest-permissioned users. Affected products confirmed by CPE strings are gitlab:gitlab community and enterprise editions across the three affected version branches (15.1-18.9.x, 18.10.x, 18.11.x). The issue was reported via HackerOne (report #3445398) and assigned by cve@gitlab.com.

RemediationAI

Upgrade to a patched release: GitLab 18.11.3, 18.10.6, or 18.9.7, all released on May 13, 2026, per the vendor patch advisory at https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/. Organizations running self-managed GitLab instances on any affected 15.1-18.11.2 release should prioritize upgrading to the nearest patched minor version. If an immediate upgrade is not feasible, a compensating control is to audit and restrict Guest-role assignments - particularly for external users or contractors - to the minimum set of projects necessary, reducing the scope of unauthorized cross-project issue access. This does not eliminate the flaw but limits the blast radius. Note that restricting Guest roles may impact legitimate collaboration workflows. GitLab SaaS customers require no action.