CVE-2025-9484

CVE-2025-9484 is an information disclosure vulnerability in GitLab Enterprise Edition (EE) affecting versions from 16.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3. The root cause lies in improper access control within GraphQL resolvers, which under certain circumstances permits authenticated users to query email addresses that should be restricted to other users.

Exploitation requires an authenticated user on the affected GitLab instance. The attacker sends specially crafted GraphQL queries to the API, bypassing intended visibility restrictions. The exact conditions that enable the leak are not publicly detailed, but the bug does not require administrative privileges or special network access beyond standard authentication.

A successful attack allows the malicious user to retrieve email addresses of other users, potentially leading to privacy breaches, targeted phishing campaigns, or further reconnaissance. The exposure of email addresses is considered a medium-severity issue (CVSS 3.1 base score 4.3).

GitLab has addressed the vulnerability in versions 18.10.3, 18.9.5, and 18.8.9, which were released on April 8, 2026. Self-managed installations are strongly recommended to upgrade immediately; GitLab.com and GitLab Dedicated customers are already protected or have no action required. No workarounds have been announced for unpatched versions [1].