GitLab Enterprise Edition contained an authorization flaw that allowed any authenticated user, under certain conditions, to retrieve the email addresses of other users via specific GraphQL queries. The vulnerability is a classic information‑disclosure issue and is categorized as CWE‑862 (Missing Authorization). No privilege escalation or code execution is possible; the impact is limited to leaking email identifiers, which could facilitate subsequent social‑engineering or phishing attacks.

All GitLab Enterprise Edition releases ranging from version 16.6 up to, but not including, 18.8.9; all 18.9 releases before 18.9.5; and all 18.10 releases before 18.10.3. Users running these affected versions should be aware that authenticated sessions can be used to query email addresses of other users through the exposed GraphQL endpoints.

The vulnerability has a CVSS score of 4.3, indicating moderate severity. EPSS scores its exploitation probability as less than 1 % and it is not listed in the CISA KEV catalog. The likely attack vector is benign; an attacker only needs valid credentials and to publish a specially crafted GraphQL request. Because the flaw involves a missing authorization check, attackers with any legitimate user account can perform the exploit, making the risk widespread across the user base of affected installations.