CVE-2019-12825

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-02-17 · updated 2026-06-17
Weakness: CWE-922

Description

Unauthorized Access to the Container Registry of other groups was discovered in GitLab Enterprise 12.0.0-pre. In other words, authenticated remote attackers can read Docker registries of other groups. When a legitimate user changes the path of a group, Docker registries are not adapted, leaving them in the old namespace. They are not protected and are available to all other users with no previous access to the repo.

Affected products

GitLab: from 12.0.1 before 12.5.0; 12.0.0, 12.0.0-pre — fixed in 12.5.0

How to fix

Upgrade to a fixed version: GitLab 12.5.0. Check the vendor advisory for mitigations.

References

https://about.gitlab.com/blog/categories/releases/
https://atomic111.github.io/article/gitlab-Unauthorized-Access-to-Container-Registry
https://about.gitlab.com/blog/categories/releases/
https://atomic111.github.io/article/gitlab-Unauthorized-Access-to-Container-Registry

Get alerted when CVE-2019-12825 or the next vulnerability affects your stack