{"id":"CVE-2025-4976","state":"PUBLISHED","title":"Exposure of Sensitive Information Due to Incompatible Policies in GitLab","description":"An issue has been discovered in GitLab EE affecting all versions from 17.0 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that, under certain circumstances, could have allowed an attacker to access internal notes in GitLab Duo responses.","publishedAt":"2025-07-24T06:05:37.730Z","updatedAt":"2025-07-24T13:36:32.546Z","severity":{"score":4.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","source":"GitLab"},"assigner":"GitLab","products":["GitLab GitLab"],"affected":[{"vendor":"GitLab","product":"GitLab","defaultStatus":"unaffected","versions":[{"version":"17.0","status":"affected","lessThan":"18.0.5","versionType":"semver"},{"version":"18.1","status":"affected","lessThan":"18.1.3","versionType":"semver"},{"version":"18.2","status":"affected","lessThan":"18.2.1","versionType":"semver"}],"repo":"git://git@gitlab.com:gitlab-org/gitlab.git","cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"]}],"references":["https://gitlab.com/gitlab-org/gitlab/-/issues/543905","https://hackerone.com/reports/3149956"],"weaknesses":["CWE-213"],"ingestedAt":"2026-10-29T20:09:23.771Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/4xxx/CVE-2025-4976.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-4976","state":"PUBLISHED","datePublished":"2025-07-24T06:05:37.730Z","dateUpdated":"2025-07-24T13:36:32.546Z","assignerShortName":"GitLab","assignerOrgId":"ceab7361-8a18-47b1-92ba-4d7d25f6715a","dateReserved":"2025-05-20T05:15:30.490Z"},"containers":{"cna":{"title":"Exposure of Sensitive Information Due to Incompatible Policies in GitLab","descriptions":[{"lang":"en","value":"An issue has been discovered in GitLab EE affecting all versions from 17.0 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that, under certain circumstances, could have allowed an attacker to access internal notes in GitLab Duo responses."}],"affected":[{"vendor":"GitLab","product":"GitLab","defaultStatus":"unaffected","versions":[{"version":"17.0","status":"affected","lessThan":"18.0.5","versionType":"semver"},{"version":"18.1","status":"affected","lessThan":"18.1.3","versionType":"semver"},{"version":"18.2","status":"affected","lessThan":"18.2.1","versionType":"semver"}],"repo":"git://git@gitlab.com:gitlab-org/gitlab.git","cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"]}],"references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/543905","name":"GitLab Issue #543905","tags":["issue-tracking","permissions-required"]},{"url":"https://hackerone.com/reports/3149956","name":"HackerOne Bug Bounty Report #3149956","tags":["technical-description","exploit","permissions-required"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-213","lang":"en","description":"CWE-213: Exposure of Sensitive Information Due to Incompatible Policies","type":"CWE"}]}],"providerMetadata":{"shortName":"GitLab","orgId":"ceab7361-8a18-47b1-92ba-4d7d25f6715a","dateUpdated":"2025-07-24T06:05:37.730Z"},"solutions":[{"lang":"en","value":"Upgrade to versions 18.0.5, 18.1.3, 18.2.1 or above."}],"credits":[{"lang":"en","value":"Thanks [rogerace](https://hackerone.com/rogerace) for reporting this vulnerability through our HackerOne bug bounty program","type":"finder"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-07-24T13:10:43.770952Z","id":"CVE-2025-4976","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-07-24T13:36:32.546Z"}}]}}}