High severity7.1OSV Advisory· Published Jan 9, 2026· Updated Jul 15, 2026
CVE-2025-13772
CVE-2025-13772
Description
GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to access and utilize AI model settings from unauthorized namespaces by manipulating namespace identifiers in API requests.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
5cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*+ 3 more
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*range: >=18.4.0,<18.5.5
- cpe:2.3:a:gitlab:gitlab:18.7.0:*:*:*:enterprise:*:*:*
- (no CPE)range: 18.4 <= versions < 18.5.5, 18.6 <= versions < 18.6.3, 18.7 <= versions < 18.7.1
- (no CPE)range: v18.6.0-ee, v18.7.0-ee
Patches
Vulnerability mechanics
References
5- about.gitlab.com/releases/2026/01/07/patch-release-gitlab-18-7-1-released/nvdRelease NotesVendor Advisory
- gitlab.com/gitlab-org/gitlab/-/issues/581268nvdBroken Link
- access.redhat.com/security/cve/CVE-2025-13772nvd
- bugzilla.redhat.com/show_bug.cginvd
- security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-13772.jsonnvd
News mentions
1- GitLab Patch Release: 18.7.1, 18.6.3, 18.5.5GitLab Security Releases · Jan 7, 2026