Volerion logoVolerion
Volerion logoVolerion

GitLab EE Information Disclosure Vulnerability in Compliance Frameworks via Crafted GraphQL Queries

Vulnerability

A vulnerability exists in GitLab Enterprise Edition (EE) versions 13.2 prior to 18.4.6, 18.5 prior to 18.5.4, and 18.6 prior to 18.6.2. This vulnerability could allow an authenticated user to disclose sensitive information from private projects by executing specially crafted GraphQL queries. The issue has been addressed in the latest patch releases.

Impact

Exploitation of this vulnerability could lead to unauthorized disclosure of sensitive information from private projects.

Remediation

Users are advised to upgrade to GitLab EE versions 18.6.2, 18.5.4, or 18.4.6.

Added: Dec 11, 2025, 5:21 AM
Updated: Dec 11, 2025, 5:21 AM

Vulnerability Rating

Custom Algorithm
spread
7.3
impact
2.5
exploitability
5.2
remediation
7.7
relevance
1.4
threat
0.0
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.