CVE-2025-9825

Published: Nov 21, 2025Modified: Oct 19, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 to 18.2.8, 18.3 before 18.3.4, and 18.4 before 18.4.2 that could have allowed authenticated users without project membership to view sensitive manual CI/CD variables by querying the GraphQL API.

Affected (6)

Products: Gitlab: Gitlab

Gitlab

1 product

Gitlab

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Gitlab Gitlab	13.7.0 ≤ version < 18.2.8
Gitlab Gitlab	18.3.0 ≤ version < 18.3.4
Gitlab Gitlab	18.4.0 ≤ version < 18.4.2
Gitlab Gitlab	13.7.0 ≤ version < 18.2.8
Gitlab Gitlab	18.3.0 ≤ version < 18.3.4
Gitlab Gitlab	18.4.0 ≤ version < 18.4.2

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (3)

https://about.gitlab.com/releases/2025/10/08/patch-release-gitlab-18-4-2-released/

Source: cve@gitlab.com

Release NotesVendor Advisory

https://gitlab.com/gitlab-org/gitlab/-/issues/567301

Source: cve@gitlab.com

ExploitIssue Tracking

https://hackerone.com/reports/3319800

Source: cve@gitlab.com

Permissions Required

Timeline

No history available yet.