CVE-2025-9484
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
In GitLab EE versions from 16.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3, an issue exists that under certain circumstances could allow an authenticated user to access other users' email addresses via GraphQL queries.
Risk Assessment
Breach of personal data confidentiality (email addresses) may lead to GDPR violations and loss of trust.
Recommendation
Update GitLab EE to version 18.8.9, 18.9.5, or 18.10.3 depending on the branch used.
Original NVD description (English source)
GitLab has remediated an issue in GitLab EE affecting all versions from 16.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that under certain circumstances could have allowed an authenticated user to have access to other users' email addresses via certain GraphQL queries.