CVE-2025-7659
Publication date 11 February 2026
Last updated 6 April 2026
Ubuntu priority
Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an unauthenticated user to steal tokens and access private repositories by abusing incomplete validation in the Web IDE.
Read the notes from the security team
Why is this CVE high priority?
Unauthenticated user can potentially access private repositories
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| gitlab | 25.10 questing | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 16.04 LTS xenial | Ignored | |
| gitlab-agent | 25.10 questing |
Not affected
|
| 24.04 LTS noble |
Not affected
|
|
| 22.04 LTS jammy | Not in release |
Notes
mdeslaur
GitLab isn't maintainable as a distro package, and was removed from Ubuntu because of this. We will not be fixing security issues in the gitlab package in Xenial.
john-breton
gitlab-agent does not rely on the WEB IDE functionality that this vulnerability requires.
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
8.0 · High
|
| Attack vector | Network |
| Attack complexity | High |
| Privileges required | None |
| User interaction | Required |
| Scope | Changed |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | None |
| Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N |