CVE-2025-4976

An issue has been discovered in GitLab EE affecting all versions from 17.0 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that, under certain circumstances, could have allowed an attacker to access internal notes in GitLab Duo responses.

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS v3.1

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.42% chance of exploitation in the next 30 days, 35th percentile

Published

2025-07-24

Proof-of-concept exploits (1)

• https://hackerone.com/reports/3149956

References

• CVE Record
• NVD entry

Related

• CVE-2025-49744
• CVE-2025-4977
• CVE-2025-49741
• CVE-2025-4978
• CVE-2025-49730
• CVE-2025-4980