CVE-2025-4976: Exposure of Sensitive Information Due to Incompatible Policies in GitLab
An issue has been discovered in GitLab EE affecting all versions from 17.0 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that, under certain circumstances, could have allowed an attacker to access internal notes in GitLab Duo responses.
Other sources
GitLab has remediated an issue that, under certain circumstances, could have allowed an attacker to access internal notes in GitLab Duo responses.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-4976?
CVE-2025-4976 has a severity rating that indicates a moderate risk of data exposure under certain conditions.
How can I fix CVE-2025-4976?
To fix CVE-2025-4976, upgrade GitLab EE to version 18.0.5 or later, or 18.1.3 or later, or 18.2.1 or later.
What versions of GitLab EE are affected by CVE-2025-4976?
CVE-2025-4976 affects GitLab EE versions from 17.0 up to, but not including, 18.0.5, 18.1 up to, but not including, 18.1.3, and 18.2 up to, but not including, 18.2.1.
What impact does CVE-2025-4976 have on GitLab users?
CVE-2025-4976 could allow an attacker to access internal notes in GitLab Duo responses, which may compromise sensitive information.
Are there any workarounds for CVE-2025-4976?
There are no recommended workarounds for CVE-2025-4976; upgrading to a patched version is the only effective solution.