Unrated severityNVD Advisory· Published Nov 15, 2025· Updated Nov 17, 2025

Insertion of Sensitive Information Into Sent Data in GitLab

CVE-2025-2615

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.7 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2, that could have allowed a blocked user to access sensitive information by establishing GraphQL subscriptions through WebSocket connections.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

GitLab Inc./GitLabv52 versions
cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*range: 16.7
- (no CPE)range: >=16.7 <18.3.6, >=18.4 <18.4.4, >=18.5 <18.5.2
osv-coords53 versions
pkg:apk/chainguard/gitlab-docker-machine-18.4 pkg:apk/chainguard/gitlab-docker-machine-18.5 pkg:apk/chainguard/gitlab-docker-machine-fips-18.4 pkg:apk/chainguard/gitlab-docker-machine-fips-18.5 pkg:apk/chainguard/gitlab-rails-ce-18.1 pkg:apk/chainguard/gitlab-rails-ce-18.2 pkg:apk/chainguard/gitlab-rails-ce-assets-18.1 pkg:apk/chainguard/gitlab-rails-ce-assets-18.2 pkg:apk/chainguard/gitlab-rails-ce-assets-fips-18.1 pkg:apk/chainguard/gitlab-rails-ce-assets-fips-18.2 pkg:apk/chainguard/gitlab-rails-ce-doc-18.1 pkg:apk/chainguard/gitlab-rails-ce-doc-18.2 pkg:apk/chainguard/gitlab-rails-ce-doc-fips-18.1 pkg:apk/chainguard/gitlab-rails-ce-doc-fips-18.2 pkg:apk/chainguard/gitlab-rails-ce-fips-18.1 pkg:apk/chainguard/gitlab-rails-ce-fips-18.2 pkg:apk/chainguard/gitlab-runner-18.4 pkg:apk/chainguard/gitlab-runner-18.5 pkg:apk/chainguard/gitlab-runner-fips-18.4 pkg:apk/chainguard/gitlab-runner-fips-18.5 pkg:apk/chainguard/gitlab-runner-helper-18.4 pkg:apk/chainguard/gitlab-runner-helper-18.5 pkg:apk/chainguard/gitlab-runner-helper-compat-18.4 pkg:apk/chainguard/gitlab-runner-helper-compat-18.5 pkg:apk/chainguard/gitlab-runner-helper-compat-fips-18.4 pkg:apk/chainguard/gitlab-runner-helper-compat-fips-18.5 pkg:apk/chainguard/gitlab-runner-helper-fips-18.4 pkg:apk/chainguard/gitlab-runner-helper-fips-18.5 pkg:apk/chainguard/gitlab-runner-helper-oci-entrypoint-18.4 pkg:apk/chainguard/gitlab-runner-helper-oci-entrypoint-18.5 pkg:apk/chainguard/gitlab-runner-helper-oci-entrypoint-fips-18.4 pkg:apk/chainguard/gitlab-runner-helper-oci-entrypoint-fips-18.5 pkg:apk/chainguard/gitlab-runner-oci-entrypoint-18.4 pkg:apk/chainguard/gitlab-runner-oci-entrypoint-18.5 pkg:apk/chainguard/gitlab-runner-oci-entrypoint-fips-18.4 pkg:apk/chainguard/gitlab-runner-oci-entrypoint-fips-18.5 pkg:apk/chainguard/gitlab-workhorse-ce-18.1 pkg:apk/chainguard/gitlab-workhorse-ce-18.2 pkg:apk/chainguard/gitlab-workhorse-ce-fips-18.1 pkg:apk/chainguard/gitlab-workhorse-ce-fips-18.2 pkg:apk/wolfi/gitlab-docker-machine-18.4 pkg:apk/wolfi/gitlab-docker-machine-18.5 pkg:apk/wolfi/gitlab-runner-18.4 pkg:apk/wolfi/gitlab-runner-18.5 pkg:apk/wolfi/gitlab-runner-helper-18.4 pkg:apk/wolfi/gitlab-runner-helper-18.5 pkg:apk/wolfi/gitlab-runner-helper-compat-18.4 pkg:apk/wolfi/gitlab-runner-helper-compat-18.5 pkg:apk/wolfi/gitlab-runner-helper-oci-entrypoint-18.4 pkg:apk/wolfi/gitlab-runner-helper-oci-entrypoint-18.5 pkg:apk/wolfi/gitlab-runner-oci-entrypoint-18.4 pkg:apk/wolfi/gitlab-runner-oci-entrypoint-18.5 pkg:bitnami/gitlab
< 18.4.0-r2+ 52 more
- (no CPE)range: < 18.4.0-r2
- (no CPE)range: < 18.5.0-r1
- (no CPE)range: < 18.4.0-r2
- (no CPE)range: < 18.5.0-r1
- (no CPE)range: < 18.1.6-r1
- (no CPE)range: < 18.2.8-r1
- (no CPE)range: < 18.1.6-r1
- (no CPE)range: < 18.2.8-r1
- (no CPE)range: < 18.1.6-r2
- (no CPE)range: < 18.2.8-r2
- (no CPE)range: < 18.1.6-r1
- (no CPE)range: < 18.2.8-r1
- (no CPE)range: < 18.1.6-r2
- (no CPE)range: < 18.2.8-r2
- (no CPE)range: < 18.1.6-r2
- (no CPE)range: < 18.2.8-r2
- (no CPE)range: < 18.4.0-r2
- (no CPE)range: < 18.5.0-r1
- (no CPE)range: < 18.4.0-r2
- (no CPE)range: < 18.5.0-r1
- (no CPE)range: < 18.4.0-r2
- (no CPE)range: < 18.5.0-r1
- (no CPE)range: < 18.4.0-r2
- (no CPE)range: < 18.5.0-r1
- (no CPE)range: < 18.4.0-r2
- (no CPE)range: < 18.5.0-r1
- (no CPE)range: < 18.4.0-r2
- (no CPE)range: < 18.5.0-r1
- (no CPE)range: < 18.4.0-r2
- (no CPE)range: < 18.5.0-r1
- (no CPE)range: < 18.4.0-r2
- (no CPE)range: < 18.5.0-r1
- (no CPE)range: < 18.4.0-r2
- (no CPE)range: < 18.5.0-r1
- (no CPE)range: < 18.4.0-r2
- (no CPE)range: < 18.5.0-r1
- (no CPE)range: < 18.1.6-r2
- (no CPE)range: < 18.2.8-r2
- (no CPE)range: < 18.1.6-r3
- (no CPE)range: < 18.2.8-r2
- (no CPE)range: < 18.4.0-r2
- (no CPE)range: < 18.5.0-r1
- (no CPE)range: < 18.4.0-r2
- (no CPE)range: < 18.5.0-r1
- (no CPE)range: < 18.4.0-r2
- (no CPE)range: < 18.5.0-r1
- (no CPE)range: < 18.4.0-r2
- (no CPE)range: < 18.5.0-r1
- (no CPE)range: < 18.4.0-r2
- (no CPE)range: < 18.5.0-r1
- (no CPE)range: < 18.4.0-r2
- (no CPE)range: < 18.5.0-r1
- (no CPE)range: >= 16.7.0, < 18.3.6

Patches

Vulnerability mechanics

References

hackerone.com/reports/3049150mitretechnical-descriptionexploitpermissions-required
gitlab.com/gitlab-org/gitlab/-/issues/526360mitreissue-trackingpermissions-required
about.gitlab.com/releases/2025/11/12/patch-release-gitlab-18-5-2-released/mitre

News mentions

GitLab Patch Release: 18.5.2, 18.4.4, 18.3.6
GitLab Security Releases · Nov 12, 2025

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000