CVE-2025-9825

MediumCVSS 6.5/10Last modified Oct 19, 2026

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 to 18.2.8, 18.3 before 18.3.4, and 18.4 before 18.4.2 that could have allowed authenticated users without project membership to view sensitive manual CI/CD variables by querying the GraphQL API.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 13.7, < 18.2.8; >= 18.3, < 18.3.4; >= 18.4, < 18.4.2

References

https://about.gitlab.com/releases/2025/10/08/patch-release-gitlab-18-4-2-released/Release Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/567301Exploit, Issue Tracking
https://hackerone.com/reports/3319800Permissions Required

Timeline

Published: Nov 21, 2025
Last modified: Oct 19, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-98265.4Stored cross-site scripting vulnerability in M-Files Hubshare before version 25.8 allows authenticated attackers to cause script execution f CVE-2025-98285.9A vulnerability was determined in Tenda CP6 11.10.00.243. The affected element is the function sub_2B7D04 of the component uhttp. Executing CVE-2025-98299.8A vulnerability was identified in PHPGurukul Beauty Parlour Management System 1.1. The impacted element is an unknown function of the file /CVE-2025-98309.8A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. This affects an unknown function of the file /admin/CVE-2025-98319.8A weakness has been identified in PHPGurukul Beauty Parlour Management System 1.1. This impacts an unknown function of the file /admin/edit-CVE-2025-98329.8A security vulnerability has been detected in SourceCodester Food Ordering Management System 1.0. Affected is an unknown function of the fil CVE-2025-98339.8A vulnerability was detected in SourceCodester Online Farm Management System 1.0. Affected by this vulnerability is an unknown functionality CVE-2025-98345.4A flaw has been found in PHPGurukul Small CRM 4.0. Affected by this issue is some unknown functionality of the file /registration.php. Execu CVE-2025-98354.3A vulnerability has been found in macrozheng mall up to 1.0.3. This affects the function cancelOrder of the file /order/cancelUserOrder. The CVE-2025-98364.3A vulnerability was found in macrozheng mall up to 1.0.3. This vulnerability affects the function paySuccess of the file /order/paySuccess. CVE-2025-98379.8A vulnerability was determined in itsourcecode Student Information Management System 1.0. This issue affects some unknown processing of the CVE-2025-98389.8A vulnerability was identified in itsourcecode Student Information Management System 1.0. Impacted is an unknown function of the file /admin