GitLab logged sensitive request data such as access tokens and secrets because of an issue that caused the system to write this information to log files and error tracking events. This flaw could allow an authenticated user with permission to view GitLab Pages logs to read those tokens and other confidential data. The weakness is classified as CWE-532, the insertion of sensitive information into logs, and represents a moderate severity confidentiality impact, potentially enabling credential theft if the exposed data is misused.

All GitLab Community Edition and Enterprise Edition releases from version 12.0 up to, but not including, 19.2.8, from 19.3 up to, but not including, 19.3.5, and from 19.4 up to, but not including, 19.4.2 were affected. The problem exists in the core GitLab application that manages Pages and its logging subsystem.

The CVSS base score of 6.2 indicates a moderate risk. An attacker must be authenticated and possess Pages log access, which most developers or system administrators may have. As the EPSS score is currently unavailable, the likelihood of exploitation in the wild cannot be quantified, and the vulnerability is not currently known to be exploited (not listed in KEV). Even so, privileged users could exploit this to gain accidental exposure of tokens and secrets, so the recommendation is to apply the vendor provided patch immediately.