CVE Vulnerabilities

CVE-2025-4976

Exposure of Sensitive Information Due to Incompatible Policies

Published: Jul 24, 2025 | Modified: Jul 28, 2025
CVSS 3.x
5.3
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu
MEDIUM

An issue has been discovered in GitLab EE affecting all versions from 17.0 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that, under certain circumstances, could have allowed an attacker to access internal notes in GitLab Duo responses.

Weakness

The product’s intended functionality exposes information to certain actors in accordance with the developer’s security policy, but this information is regarded as sensitive according to the intended security policies of other stakeholders such as the product’s administrator, users, or others whose information is being processed.

Affected Software

Name Vendor Start Version End Version
Gitlab Gitlab 17.0.0 (including) 18.0.5 (excluding)
Gitlab Gitlab 18.1.0 (including) 18.1.3 (excluding)
Gitlab Gitlab 18.2 (including) 18.2 (including)
Gitlab Ubuntu esm-apps/xenial *

Extended Description

When handling information, the developer must consider whether the information is regarded as sensitive by different stakeholders, such as users or administrators. Each stakeholder effectively has its own intended security policy that the product is expected to uphold. When a developer does not treat that information as sensitive, this can introduce a vulnerability that violates the expectations of the product’s users.

References