GitLab Enterprise Edition contains an authorization flaw that allows an authenticated user with a custom role to view, create, or delete protected environment configurations even when CI/CD visibility is disabled for the project. The flaw permits unauthorized access to configuration data that is normally restricted in protected environments.

GitLab Enterprise Edition versions 17.9 through 18.11.5, 19.0 through 19.0.2, and 19.1 through 19.1.0 are affected. All releases from 18.11.6, 19.0.3, 19.1.1 onward contain the fix.

The CVSS score of 3.8 indicates a low overall risk. Exploitation requires a valid authenticated session with custom role permissions, so the attack is credential-based. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The overall likelihood of widespread exploitation is considered limited, though it remains a concern in environments that grant extensive custom role permissions.