CVE-2025-4976

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-4976
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-4976.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-4976
Aliases
Downstream
Published
2025-07-24T06:05:37.730Z
Modified
2026-04-10T05:29:03.677676Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Exposure of Sensitive Information Due to Incompatible Policies in GitLab
Details

An issue has been discovered in GitLab EE affecting all versions from 17.0 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that, under certain circumstances, could have allowed an attacker to access internal notes in GitLab Duo responses.

Database specific 
{
    "cwe_ids": [
        "CWE-213"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/4xxx/CVE-2025-4976.json",
    "cna_assigner": "GitLab"
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
8c75d0bf4a4190d94326f1a854d0a102ceca4392
Fixed
5ca0e4219f737f6f0cd4b3f882dfabd5a923e559
Database specific 
{
    "versions": [
        {
            "introduced": "17.0"
        },
        {
            "fixed": "18.0.5"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
e0f3b86408aa4e7f03b63ac9e7dba6de1df14e93
Fixed
c7ee7561779f200b01cfef218bac36f6688e6d75
Database specific 
{
    "versions": [
        {
            "introduced": "18.1"
        },
        {
            "fixed": "18.1.3"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
64403a0daee4413eb45b939590f37c351b8e72bf
Fixed
289574e3868fe846e00792ca15174fdb20a506ab
Database specific 
{
    "versions": [
        {
            "introduced": "18.2"
        },
        {
            "fixed": "18.2.1"
        }
    ]
}

Affected versions

v18.*
v18.1.0-ee
v18.2.0-ee

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-4976.json"