CVE-2025-9958: 
GitLab vulnerability analysis and mitigation

An information disclosure vulnerability (CVE-2025-9958) was discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1. The vulnerability could allow low privileged users to access sensitive information stored in virtual registry configurations (GitLab Release, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The flaw specifically affects the virtual registry configuration component and is classified under CWE-201 (Insertion of Sensitive Information Into Sent Data) (GitLab Release, NVD).

The vulnerability allows Guest users to access sensitive information stored in virtual registry configurations, potentially exposing confidential registry tokens and configuration data (Cybersecurity News, GitLab Release).

GitLab has released patched versions 18.4.1, 18.3.3, and 18.2.7 to address this vulnerability. Administrators of self-managed GitLab instances are strongly recommended to upgrade immediately to one of these versions. GitLab.com is already running the patched version, and GitLab Dedicated customers do not need to take action (GitLab Release).

The vulnerability was responsibly disclosed through GitLab's HackerOne bug bounty program by security researcher joaxcar. The discovery and patch release were part of a larger security update that addressed multiple vulnerabilities in GitLab (GitLab Release, Cybersecurity News).