Loading vulnerability…
Rejected CVE record for GitLab EE Planner-role analytics access
CVE-2025-0307 is a rejected CVE record. The CVE entry indicates that the identifier was rejected or withdrawn by its CVE Numbering Authority. Although public reporting associated this identifier with an improper authorization issue in GitLab Enterprise Edition that allowed users with the Planner role to access code review analytics and potentially sensitive project analytics data in private projects, the CVE itself is not valid for vulnerability tracking in its rejected state.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
The rejected CVE record does not provide authoritative vulnerability impact details. Based on associated reporting, the underlying issue was described as unauthorized disclosure of potentially sensitive project analytics information in private GitLab EE projects to users with limited permissions.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, reducing exposure would require limiting assignment of the Planner role in private projects and restricting access to analytics features until a fixed version is deployed. However, specific vendor-endorsed mitigations are not available from the rejected CVE record.
Patch, then assume compromise.
Because this CVE identifier is rejected, remediation should not rely on the CVE record itself. Associated reporting states that the issue was addressed in GitLab versions 17.7.6, 17.8.4, and 17.9.1, and upgrading to a fixed release is the stated corrective action for affected self-managed installations.
No public exploits tracked yet. Mallory keeps watching.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.