CSRF Vulnerability in GitLab EE Affecting Multiple Versions

CVE-2025-11990

What is CVE-2025-11990?

GitLab EE has addressed a critical issue related to Cross-Site Request Forgery (CSRF) vulnerabilities, impacting all versions from 18.4 prior to 18.4.4, and 18.5 before 18.5.2. This vulnerability allowed authenticated users to exploit weaknesses in input validation of repository references, leading to the potential unauthorized retrieval of CSRF tokens. Such exploits stem from improper handling of redirects when processing requests, thereby compromising the integrity of user sessions and allowing attackers to perform unauthorized actions on behalf of legitimate users.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References