Cyber Resilience

CVE-2025-2615

Info Disclosure in Gitlab 16.7.0 – 18.3.6

Published
15 November 2025
Modified
19 November 2025
Patch / advisory
CVSS Score v3.1 4.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.0031 23th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2025-2615 is a medium-severity Insertion of Sensitive Information Into Sent Data (CWE-201) vulnerability in Gitlab Gitlab. Its CVSS base score is 4.3 (Medium).

Operationally, ranked at the 23th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-2 (Account Management) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.7 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2, that could have allowed a blocked user to access sensitive information by establishing GraphQL subscriptions through WebSocket connections.

CWE(s)

Related Threats

CVEs Like This One

CVE-2023-3413Same product: Gitlab Gitlab
CVE-2023-1401Same product: Gitlab Gitlab
CVE-2025-9958Same product: Gitlab Gitlab
CVE-2023-5831Same product: Gitlab Gitlab
CVE-2023-1825Same product: Gitlab Gitlab
CVE-2025-7000Same product: Gitlab Gitlab
CVE-2023-3102Same product: Gitlab Gitlab
CVE-2023-3399Same product: Gitlab Gitlab
CVE-2023-4002Same product: Gitlab Gitlab
CVE-2023-3949Same product: Gitlab Gitlab

Affected Assets

gitlab
gitlab
16.7.0 — 18.3.6 · 16.7.0 — 18.3.6 · 18.4.0 — 18.4.4

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • AC-2 Account Management
  • SC-23 Session Authenticity
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 1 hardening rule · 1 OS baseline
Validate
Prove the fix (OWASP ASVS)
  • V14.2.3

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly enforces authorization decisions so that blocked user accounts cannot establish GraphQL subscriptions or receive sensitive data over WebSocket connections.

prevent

Requires explicit disabling or blocking of accounts with corresponding enforcement that prevents subsequent resource access including new WebSocket sessions.

prevent

Protects session authenticity for WebSocket connections, ensuring a blocked user's session state cannot be used to obtain unauthorized information via GraphQL subscriptions.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly prevent insertion of sensitive data into application outputs and messages.

DE.CM-09 partial match
prevents

Monitoring runtime data flows and outputs can detect sensitive data being transmitted.

PR.DS-02 partial match
prevents

Protecting data-in-transit can include filtering or encrypting to avoid exposing sensitive content.

PR.DS-10 partial match
prevents

Protecting data-in-use includes removing confidential values before they are processed or sent.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Data-masking techniques can prevent sensitive values from appearing in transmitted payloads.

mitigates

Classification identifies sensitive data so it is not inadvertently transmitted.

mitigates

Labelling makes sensitive data visible to developers and prevents accidental inclusion in outbound messages.

mitigates

Information-transfer rules directly govern what data may be sent to external parties.

mitigates

PII-protection requirements reduce the chance of sending personal data to unauthorized recipients.

mitigates

DLP controls inspect and block outbound flows that contain sensitive information.

References