GitLab Patches Multiple Flaws Allowing Authentication Bypass and DoS Attacks

GitLab has released security patches addressing six vulnerabilities across versions 18.6.1, 18.5.3, and 18.4.5 for both Community Edition (CE) and Enterprise Edition (EE).

The company strongly recommends that all self-managed GitLab installations upgrade immediately to remediate these flaws, which range from authentication bypasses to denial-of-service conditions.

Critical Vulnerabilities Patched

Two high-severity vulnerabilities pose the most immediate risk to GitLab deployments.

CVE ID	Title	Severity	CVSS Score	Type
CVE-2024-9183	Race condition issue in CI/CD cache	High	7.7	Credential theft / Privilege escalation
CVE-2025-12571	Denial of Service in JSON validation	High	7.5	Denial of Service (DoS)
CVE-2025-12653	Authentication bypass in account registration	Medium	6.5	Authentication Bypass
CVE-2025-7449	Denial of Service in HTTP response processing	Medium	6.5	Denial of Service (DoS)
CVE-2025-6195	Improper authorization in markdown rendering	Medium	4.3	Information Disclosure
CVE-2025-13611	Information disclosure in Terraform registry	Low	2.4	Information Disclosure

The first, CVE-2024-9183, involves a race condition in the CI/CD cache system that could allow authenticated users to steal credentials from higher-privileged accounts and execute actions in their context.

With a CVSS score of 7.7, this vulnerability affects versions 18.4, 18.5, and 18.6 before the patched releases.

The second high-severity flaw, CVE-2025-12571, is a denial-of-service vulnerability in JSON input validation middleware.

This flaw is particularly concerning because it requires no authentication unauthenticated attackers can send specially crafted JSON payloads to crash the service. Scoring 7.5 on the CVSS scale, this vulnerability impacts versions dating back to 17.10.

CVE-2025-12653 reveals an authentication bypass in the account registration process. Under specific conditions, unauthenticated users could manipulate HTTP headers to join arbitrary organizations without proper verification.

This medium-severity vulnerability (CVSS 6.5) undermines organizational access controls across affected versions of GitLab.

A separate medium-severity denial-of-service vulnerability, CVE-2025-7449, affects HTTP response processing.

Unlike the JSON validation DoS, this flaw requires an authenticated user with specific permissions to trigger, maintaining a CVSS score of 6.5.

GitLab also patched two information disclosure vulnerabilities. CVE-2025-6195 could allow authenticated users to access security report information through improper authorization in markdown rendering, while CVE-2025-13611 exposes sensitive tokens in Terraform registry logs to privileged users.

GitLab.com is already running the patched versions, while GitLab Dedicated customers require no action.

However, all self-managed installations must prioritize upgrades immediately. The company emphasizes maintaining security hygiene by updating to the latest patch for your supported version.

Organizations unable to update immediately should implement compensating controls to restrict access to potentially vulnerable components.

Monitoring logs for suspicious JSON payloads, unauthorized organization joins, and unusual CI/CD cache access patterns can help detect exploitation attempts.

GitLab disclosed these vulnerabilities through its HackerOne bug bounty program, with the security issues becoming publicly available 30 days after patch release on GitLab’s issue tracker.

All patch details and recommended security practices are available on GitLab’s official release blog and security documentation.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.