CVE-2025-9484

Received Received - Intake

GraphQL Information Disclosure in GitLab EE Allows Email Access

Publication date: 2026-04-08

Last updated on: 2026-04-14

Assigner: GitLab Inc.

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 16.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that under certain circumstances could have allowed an authenticated user to have access to other users' email addresses via certain GraphQL queries.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-08

Last Modified

2026-04-14

Generated

2026-07-06

AI Q&A

2026-04-09

EPSS Evaluated

2026-07-05

NVD

CVE-2025-9484

EUVD

EUVD-2025-209367

Affected Vendors & Products

Vendor	Product	Version / Range
gitlab	gitlab	From 18.9.0 (inc) to 18.9.5 (exc)
gitlab	gitlab	From 18.10.0 (inc) to 18.10.3 (exc)
gitlab	gitlab	From 16.6.0 (inc) to 18.8.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in GitLab EE affects versions from 16.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3. Under certain circumstances, it could allow an authenticated user to access other users' email addresses through specific GraphQL queries.

Impact Analysis

The vulnerability could lead to unauthorized disclosure of users' email addresses to authenticated users who should not have access to that information. This could result in privacy breaches and potential misuse of email addresses.

Compliance Impact

This vulnerability could allow an authenticated user to access other users' email addresses under certain circumstances.

Exposure of email addresses may have implications for compliance with data protection regulations such as GDPR and HIPAA, which require protection of personally identifiable information.

However, specific impacts on compliance or regulatory requirements are not detailed in the provided information.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade GitLab EE to a fixed version. Specifically, update to version 18.8.9 or later if you are on the 16.6 to 18.8 series, version 18.9.5 or later if you are on the 18.9 series, or version 18.10.3 or later if you are on the 18.10 series.

Hi! I’m here to help you understand CVE-2025-9484. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70