A flaw in GitLab Community and Enterprise Editions allows an authenticated user to view metadata from private issues, merge requests, epics, milestones, or commits. The vulnerability arises from incorrect filtering in the snippet rendering process, meaning that private information can be exposed to users who normally should not have access. This results in a confidentiality compromise but does not grant elevated privileges or denial of service.

All GitLab Community Edition and Enterprise Edition releases from version 15.6 up to but excluding 18.7.6, 18.8.6, and 18.9.2 are affected.

The CVSS score of 4.3 indicates low severity, and the EPSS score of less than 1% reflects a small likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated session and manipulating snippet content; it does not provide privilege escalation or remote code execution. The risk is thus limited to accidental or malicious exposure of private metadata within authenticated users.