The vulnerability stems from missing authorization in certain GraphQL queries within GitLab Enterprise Edition, allowing any authenticated user to retrieve the email addresses of other users. This flaw exposes personally identifying information that can be misused in credential‑recovery or social‑engineering attacks. The weakness is classified as an authorization failure (CWE‑862).

Affected versions of GitLab Enterprise Edition range from 16.6 through 18.8.8, 18.9.4, and 18.10.2. All releases prior to 18.8.9, 18.9.5, and 18.10.3 contain the flaw. Applying the vendor’s patch by upgrading to version 18.8.9, 18.9.5, 18.10.3, or any later release removes the vulnerability.

The CVSS score of 4.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no public exploitation known. Because the exploit requires only authenticated access, any user with valid credentials could abuse the flaw; however, the lack of a publicly disclosed exploit reduces immediate risk.