An improper authorization check in GitLab Enterprise Edition allows an authenticated user with guest-level permissions to read private security policy content that they would normally be denied access to. This can lead to unauthorized disclosure of sensitive security configuration details. The weakness is classified as CWE‑863, improper authorization.

GitLab EE is impacted. Affected releases include all versions from 17.9 up to 19.2.6, 19.3 up to 19.3.2, and 19.4 up to 19.4.0. The fix is released in 19.2.7, 19.3.3, and 19.4.1 or later.

The CVSS v3.1 score is 4.3, indicating moderate severity. The EPSS score is less than 1%, showing a low probability of exploitation at this time and the vulnerability is not listed in the CISA KEV catalog. Because the flaw only applies to authenticated guest users, an attacker must have valid credentials and be granted guest access. The vulnerability could be exploited by navigating to a private security policy through the web interface or API, but no public exploit has been identified.