GitLab identified a flaw where an authenticated user could retrieve historical pipeline job data from projects that had both the repository and CI/CD features disabled. This improper authorization check violates the principle of least privilege, allowing users to view sensitive build artifacts and logs, potentially exposing internal project details or facilitating further attacks. The weakness is categorized as CWE-863, indicating an access control bypass.

Affected versions include all GitLab Community Edition (CE) and Enterprise Edition (EE) releases from 15.1 up to but not including 18.7.6, from 18.8 up to but not including 18.8.6, and from 18.9 up to but not including 18.9.2. The products are listed under the vendor GitLab:GitLab for both community and enterprise editions.

The CVSS score is 4.3, reflecting medium severity. EPSS indicates a very low probability of exploitation (<1%). The vulnerability is not listed in CISA's KEV catalog. Exploit requires an authenticated GitLab account with standard user permissions and depends on the project having disabled repository and CI/CD features. Based on the description, the likely attack vector is local possession of legitimate credentials; remote exploitation without authentication is not supported by the data.