CVE-2025-1908

An issue has been discovered in GitLab EE/CE that could allow an attacker to track users' browsing activities, potentially leading to full account take-over, affecting all versions from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1.

View graph Watch Export

CVSS v3.1

7.7 HIGH

EPSS

0.38%

probability of exploitation in 30 days

CISA KEV

Not listed

no confirmed exploitation reported

News coverage

sources referencing this CVE

EPSS Trend

Aug 16, 2026 → Aug 29, 2026

● 0.01pp

0.38% → 0.38% over 2 tracked changes

CVSS v3.1 Detail

Attack VectorNETWORK

Attack ComplexityHIGH

Privileges RequiredLOW

User InteractionREQUIRED

ScopeCHANGED

ConfidentialityHIGH

IntegrityHIGH

AvailabilityNONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Connections

2 relationships

CWE-840

source

Timeline

disclosure → media coverage

Apr 24, 2025

Disclosure — published as a CVE record. · last revised by NVD Aug 8, 2025