CVE-2025-9484
GraphQL Information Disclosure in GitLab EE Allows Email Access
Publication date: 2026-04-08
Last updated on: 2026-04-14
Assigner: GitLab Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gitlab | gitlab | From 18.9.0 (inc) to 18.9.5 (exc) |
| gitlab | gitlab | From 18.10.0 (inc) to 18.10.3 (exc) |
| gitlab | gitlab | From 16.6.0 (inc) to 18.8.9 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in GitLab EE affects versions from 16.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3. Under certain circumstances, it could allow an authenticated user to access other users' email addresses through specific GraphQL queries.
How can this vulnerability impact me? :
The vulnerability could lead to unauthorized disclosure of users' email addresses to authenticated users who should not have access to that information. This could result in privacy breaches and potential misuse of email addresses.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability could allow an authenticated user to access other users' email addresses under certain circumstances.
Exposure of email addresses may have implications for compliance with data protection regulations such as GDPR and HIPAA, which require protection of personally identifiable information.
However, specific impacts on compliance or regulatory requirements are not detailed in the provided information.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade GitLab EE to a fixed version. Specifically, update to version 18.8.9 or later if you are on the 16.6 to 18.8 series, version 18.9.5 or later if you are on the 18.9 series, or version 18.10.3 or later if you are on the 18.10 series.