Medium severity4.3NVD Advisory· Published Nov 15, 2025· Updated Jun 17, 2026

CVE-2025-2615

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.7 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2, that could have allowed a blocked user to access sensitive information by establishing GraphQL subscriptions through WebSocket connections.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

osv-coords53 versions
pkg:apk/chainguard/gitlab-runner-fips-18.5 pkg:apk/chainguard/gitlab-runner-helper-18.5 pkg:apk/chainguard/gitlab-runner-helper-compat-18.4 pkg:apk/wolfi/gitlab-runner-helper-18.4 pkg:apk/wolfi/gitlab-runner-helper-18.5 pkg:apk/wolfi/gitlab-runner-helper-oci-entrypoint-18.4 pkg:bitnami/gitlab pkg:apk/chainguard/gitlab-docker-machine-fips-18.5 pkg:apk/chainguard/gitlab-rails-ce-18.1 pkg:apk/chainguard/gitlab-rails-ce-assets-18.1 pkg:apk/chainguard/gitlab-rails-ce-assets-18.2 pkg:apk/chainguard/gitlab-rails-ce-assets-fips-18.1 pkg:apk/chainguard/gitlab-rails-ce-doc-18.2 pkg:apk/chainguard/gitlab-rails-ce-doc-fips-18.1 pkg:apk/chainguard/gitlab-rails-ce-fips-18.1 pkg:apk/chainguard/gitlab-rails-ce-fips-18.2 pkg:apk/chainguard/gitlab-runner-18.4 pkg:apk/chainguard/gitlab-runner-18.5 pkg:apk/chainguard/gitlab-runner-helper-compat-fips-18.4 pkg:apk/chainguard/gitlab-runner-helper-oci-entrypoint-fips-18.4 pkg:apk/wolfi/gitlab-runner-helper-compat-18.5 pkg:apk/wolfi/gitlab-runner-oci-entrypoint-18.4 pkg:apk/wolfi/gitlab-runner-oci-entrypoint-18.5 pkg:apk/chainguard/gitlab-runner-fips-18.4 pkg:apk/chainguard/gitlab-runner-helper-oci-entrypoint-18.4 pkg:apk/wolfi/gitlab-docker-machine-18.5 pkg:apk/wolfi/gitlab-runner-18.4 pkg:apk/wolfi/gitlab-runner-helper-compat-18.4 pkg:apk/wolfi/gitlab-runner-helper-oci-entrypoint-18.5 pkg:apk/chainguard/gitlab-rails-ce-assets-fips-18.2 pkg:apk/chainguard/gitlab-rails-ce-doc-18.1 pkg:apk/chainguard/gitlab-rails-ce-doc-fips-18.2 pkg:apk/chainguard/gitlab-runner-helper-compat-18.5 pkg:apk/chainguard/gitlab-runner-helper-fips-18.4 pkg:apk/chainguard/gitlab-runner-helper-fips-18.5 pkg:apk/chainguard/gitlab-runner-helper-oci-entrypoint-18.5 pkg:apk/chainguard/gitlab-runner-oci-entrypoint-fips-18.5 pkg:apk/chainguard/gitlab-workhorse-ce-fips-18.1 pkg:apk/wolfi/gitlab-runner-18.5 pkg:apk/chainguard/gitlab-runner-helper-18.4 pkg:apk/chainguard/gitlab-runner-helper-oci-entrypoint-fips-18.5 pkg:apk/chainguard/gitlab-runner-oci-entrypoint-18.4 pkg:apk/chainguard/gitlab-runner-oci-entrypoint-18.5 pkg:apk/chainguard/gitlab-workhorse-ce-18.1 pkg:apk/chainguard/gitlab-workhorse-ce-18.2 pkg:apk/chainguard/gitlab-rails-ce-18.2 pkg:apk/chainguard/gitlab-runner-helper-compat-fips-18.5 pkg:apk/chainguard/gitlab-docker-machine-18.4 pkg:apk/chainguard/gitlab-docker-machine-18.5 pkg:apk/wolfi/gitlab-docker-machine-18.4 pkg:apk/chainguard/gitlab-docker-machine-fips-18.4 pkg:apk/chainguard/gitlab-workhorse-ce-fips-18.2 pkg:apk/chainguard/gitlab-runner-oci-entrypoint-fips-18.4
< 18.5.0-r1+ 52 more
- (no CPE)range: < 18.5.0-r1
- (no CPE)range: < 18.5.0-r1
- (no CPE)range: < 18.4.0-r2
- (no CPE)range: < 18.4.0-r2
- (no CPE)range: < 18.5.0-r1
- (no CPE)range: < 18.4.0-r2
- (no CPE)range: >= 16.7.0, < 18.3.6
- (no CPE)range: < 18.5.0-r1
- (no CPE)range: < 18.1.6-r1
- (no CPE)range: < 18.1.6-r1
- (no CPE)range: < 18.2.8-r1
- (no CPE)range: < 18.1.6-r2
- (no CPE)range: < 18.2.8-r1
- (no CPE)range: < 18.1.6-r2
- (no CPE)range: < 18.1.6-r2
- (no CPE)range: < 18.2.8-r2
- (no CPE)range: < 18.4.0-r2
- (no CPE)range: < 18.5.0-r1
- (no CPE)range: < 18.4.0-r2
- (no CPE)range: < 18.4.0-r2
- (no CPE)range: < 18.5.0-r1
- (no CPE)range: < 18.4.0-r2
- (no CPE)range: < 18.5.0-r1
- (no CPE)range: < 18.4.0-r2
- (no CPE)range: < 18.4.0-r2
- (no CPE)range: < 18.5.0-r1
- (no CPE)range: < 18.4.0-r2
- (no CPE)range: < 18.4.0-r2
- (no CPE)range: < 18.5.0-r1
- (no CPE)range: < 18.2.8-r2
- (no CPE)range: < 18.1.6-r1
- (no CPE)range: < 18.2.8-r2
- (no CPE)range: < 18.5.0-r1
- (no CPE)range: < 18.4.0-r2
- (no CPE)range: < 18.5.0-r1
- (no CPE)range: < 18.5.0-r1
- (no CPE)range: < 18.5.0-r1
- (no CPE)range: < 18.1.6-r3
- (no CPE)range: < 18.5.0-r1
- (no CPE)range: < 18.4.0-r2
- (no CPE)range: < 18.5.0-r1
- (no CPE)range: < 18.4.0-r2
- (no CPE)range: < 18.5.0-r1
- (no CPE)range: < 18.1.6-r2
- (no CPE)range: < 18.2.8-r2
- (no CPE)range: < 18.2.8-r1
- (no CPE)range: < 18.5.0-r1
- (no CPE)range: < 18.4.0-r2
- (no CPE)range: < 18.5.0-r1
- (no CPE)range: < 18.4.0-r2
- (no CPE)range: < 18.4.0-r2
- (no CPE)range: < 18.2.8-r2
- (no CPE)range: < 18.4.0-r2
GitLab Inc./GitLab3 versions
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*+ 2 more
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*range: >=16.7.0,<18.3.6
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*range: >=16.7.0,<18.3.6
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*range: 16.7
GitLab Inc./GitLab EE and CEllm-fuzzy
Range: from 16.7 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2

Patches

Vulnerability mechanics

References

about.gitlab.com/releases/2025/11/12/patch-release-gitlab-18-5-2-released/nvdRelease NotesVendor Advisory
gitlab.com/gitlab-org/gitlab/-/issues/526360nvdBroken Link
hackerone.com/reports/3049150nvdPermissions Required

News mentions

GitLab Patch Release: 18.5.2, 18.4.4, 18.3.6
GitLab Security Releases · Nov 12, 2025

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000