GitLab’s Enterprise and Community editions contain an access control flaw that allows an authenticated user with a Planner role to view security category metadata and attributes in group security configuration. This improper authorization vulnerability exposes confidential configuration information that could give an attacker insight into the organization’s security posture. The weakness is classified as CWE-862 and can lead to unintended disclosure of sensitive data.

The affected versions are all releases from 18.6 up to, but not including, 18.8.7; from 18.9 up to, but not including, 18.9.3; and from 18.10 up to, but not including, 18.10.1. Both the Community and Enterprise builds are impacted, as indicated by the CPE entries for version 18.10.0 and earlier.

The CVSS score of 4.3 indicates moderate impact, while the EPSS score of less than 1% suggests a low likelihood of real‑world exploitation. The vulnerability is not listed in CISA’s KEV catalog, further implying limited known exploitation. Attackers must first obtain authenticated credentials with Planner permissions, meaning social engineering or credential compromise is required. Because the flaw only reveals configuration data and does not provide code execution or privilege escalation, the primary concern is confidentiality loss rather than a direct compromise of the system. Nonetheless, organizations should prioritize patching to eliminate this information disclosure risk.