CVE-2025-9484

CVE-2025-9484 is an information disclosure vulnerability in GitLab Enterprise Edition that allows authenticated users to access other users' email addresses through specific GraphQL queries. The vulnerability affects multiple versions across three release branches: 16.6 through 18.8.8, 18.9 through 18.9.4, and 18.10 through 18.10.2, with patches available in versions 18.8.9, 18.9.5, and 18.10.3 respectively. The vulnerability carries a CVSS score of 4.3 (Medium severity) with a network-based attack vector requiring low complexity and valid user credentials, but no user interaction. The impact is limited to confidentiality; integrity and availability are not affected. The EPSS score of 0.00014 indicates very low probability of exploitation relative to other CVEs, and the vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog. There is no evidence of active exploitation in the wild. No public exploit code has been identified, and community attention remains minimal based on the inactive status and low engagement metrics. Organizations using affected GitLab EE versions should prioritize patching as a routine maintenance task rather than an urgent security response.