CVE-2025-9484: Missing Authorization in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 16.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that under certain circumstances could have allowed an authenticated user to have access to other users' email addresses via certain GraphQL queries.
Other sources
GitLab has remediated an issue that under certain circumstances could have allowed an authenticated user to have access to other users’ email addresses via certain GraphQL queries.
— GitLab
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.8.9Fixed in 18.9.5Fixed in 18.10.3 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 18.8.9 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 18.9.5 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 18.10.3
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-9484?
CVE-2025-9484 is classified as a moderate severity information disclosure vulnerability.
How do I fix CVE-2025-9484?
To remediate CVE-2025-9484, you should upgrade GitLab EE to version 18.8.9, 18.9.5, or 18.10.3.
Which versions of GitLab EE are affected by CVE-2025-9484?
CVE-2025-9484 affects GitLab EE versions from 16.6 up to, but not including, 18.8.9, 18.9 up to, but not including, 18.9.5, and 18.10 up to, but not including, 18.10.3.
Who is impacted by CVE-2025-9484?
Authenticated users of affected GitLab EE versions may experience information disclosure due to CVE-2025-9484.
What type of vulnerability is CVE-2025-9484?
CVE-2025-9484 is categorized as an information disclosure vulnerability in the GitLab EE service.