VYPR
← All advisories
Low severity3.1NVD Advisory· Published Nov 15, 2025· Updated Jun 17, 2026

CVE-2025-11990

CVE-2025-11990

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated user to gain CSRF tokens by exploiting improper input validation in repository references combined with redirect handling weaknesses.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • osv-coords
    pkg:bitnami/gitlab
    Range: >= 18.4.0, < 18.4.4
  • GitLab Inc./GitLab2 versions
    cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*+ 1 more
    • cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*range: >=18.4.0,<18.4.4
    • cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*range: 18.4
  • GitLab Inc./gitlab-org/gitlab-eellm-fuzzy
    Range: from 18.4 before 18.4.4, and 18.5 before 18.5.2

Patches

Vulnerability mechanics

References

3

News mentions

1