PT-2026-31537 · Gitlab · Gitlab Ce/Ee

Published 2026-04-08 · Updated 2026-04-13 · CVE-2025-9484

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab EE versions 16.6 through 18.8.8, 18.9 through 18.9.4, and 18.10 through 18.10.2

Description GitLab EE versions are affected by an issue that, under certain circumstances, could allow an authenticated user to access other users' email addresses via specific GraphQL queries.

Recommendations Update to GitLab EE version 18.8.9 or later. Update to GitLab EE version 18.9.5 or later. Update to GitLab EE version 18.10.3 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2026-04882

BIT-GITLAB-2025-9484

CVE-2025-9484

Affected Products

Gitlab Ce/Ee

References · 12

• 🔥 https://hackerone.com/reports/3303810 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-9484 · Security Note
• https://bdu.fstec.ru/vul/2026-04882 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-9484 · Security Note
• https://about.gitlab.com/releases/2026/04/08/patch-release-gitlab-18-10-3-released · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2025-9484 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-9484 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-9484 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2042157246587523118 · Twitter Post
• https://twitter.com/CVEnew/status/2042010542538187211 · Twitter Post
• https://gitlab.com/gitlab-org/gitlab/-/issues/565363 · Note
• https://twitter.com/infoflowcloud/status/2042012364455710931 · Twitter Post