CVE-2025-12653
Auth Bypass in Gitlab 18.3.0 – 18.4.5
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NSummary
CVE-2025-12653 is a medium-severity Authentication Bypass by Spoofing (CWE-290) vulnerability in Gitlab Gitlab. Its CVSS base score is 6.5 (Medium).
Operationally, ranked at the 20th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-14 (Permitted Actions Without Identification or Authentication) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-199760
Vulnerability Data
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that under specific conditions could have allowed an unauthenticated user to join arbitrary organizations by changing headers on…
more
some requests.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
- 3 hardening rules · 3 OS baselines
V6.4.3V10.4.16V10.5.1V11.4.3
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces authorization decisions on organization-join requests so that header manipulation cannot grant access without valid authentication.
Requires validation of HTTP headers used for authentication context, blocking the spoofing vector that allows unauthenticated joins.
Explicitly identifies and restricts actions (such as joining organizations) that may be performed without identification or authentication.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Protecting, conveying, and verifying identity assertions specifically prevents the spoofing that enables authentication bypass.
Requiring authentication of users/services/hardware directly counters spoofing-based bypass when strong methods are used.
Proofing and binding identities reduces spoofing opportunities during enrollment but does not address runtime authentication implementation flaws.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure authentication control directly mitigates authentication bypass by spoofing.
Authentication information management directly addresses credential handling that prevents spoofing.
Security testing can detect spoofing vulnerabilities but does not prevent them by itself.
Access control policy reduces spoofing opportunities but does not prescribe authentication mechanisms.
Identity management supports unique identities but does not guarantee resistance to spoofing.
Access rights assignment limits exposure but does not enforce authentication strength.