CVE-2019-12825

Unauthorized Access to the Container Registry of other groups was discovered in GitLab Enterprise 12.0.0-pre. In other words, authenticated remote attackers can read Docker registries of other groups. When a legitimate user changes the path of a group, Docker registries are not adapted, leaving them in the old namespace. They are not protected and are available to all other users with no previous access to the repo.

• CWE-922

• https://about.gitlab.com/blog/categories/releases/Release Notes, Vendor Advisory
• https://atomic111.github.io/article/gitlab-Unauthorized-Access-to-Container-RegistryThird Party Advisory
• https://about.gitlab.com/blog/categories/releases/Release Notes, Vendor Advisory
• https://atomic111.github.io/article/gitlab-Unauthorized-Access-to-Container-RegistryThird Party Advisory

Published

Feb 17, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-12819An issue was discovered in the Linux kernel before 5.0. The …
• CVE-2019-1282An information disclosure exists in the Windows Common Log F…5.5
• CVE-2019-12820A vulnerability was found in the app 2.0 of the Shenzhen Jis…
• CVE-2019-12821A vulnerability was found in the app 2.0 of the Shenzhen Jis…
• CVE-2019-12822In http.c in Embedthis GoAhead before 4.1.1 and 5.x before 5…
• CVE-2019-12823Craft CMS before 3.1.31 does not properly filter XML feeds a…6.1
• CVE-2019-12826A Cross-Site-Request-Forgery (CSRF) vulnerability in widget_…
• CVE-2019-12827Buffer overflow in res_pjsip_messaging in Digium Asterisk ve…
• CVE-2019-12828An issue was discovered in Electronic Arts Origin before 10.…
• CVE-2019-12829radare2 through 3.5.1 mishandles the RParse API, which allow…
• CVE-2019-1283An information disclosure vulnerability exists in the way th…5.5
• CVE-2019-12830In MyBB before 1.8.21, an attacker can exploit a parsing fla…