A vulnerability in GitLab Enterprise Edition could allow an authenticated user to view Virtual Registry data in groups to which they do not belong. The flaw is a missing authorization check under certain conditions, allowing unintended data exposure. The primary impact is a confidentiality breach, permitting non‑members to access sensitive registry artifacts that should be restricted to group members. The weakness is identified as CWE-862, "Missing Authorization."

GitLab is affected. All Enterprise Edition releases from version 18.2 through 18.6, 18.8 through 18.8.5, and 18.9 before 18.9.2 are vulnerable. The fix is implemented in GitLab EE 18.7.6, 18.8.6, 18.9.2, and any later releases.

The CVSS score is 3.5, indicating low severity, and the EPSS score is below 1%, implying a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be an authenticated GitLab user; the attacker must have valid credentials and then attempt to access the virtual registry of a group to which they are not a member. Once authenticated, the improper authorization logic permits reading the registry content.