GitLab Route: A caching mechanism that is meant to consolidate rendered merge request views incorrectly uses a viewer‑independent key. When a merge request in a publicly visible project references a confidential issue from a private project, the cached content—normally redacted per user—was shared across all view‑shared cache entries. As a result, an authenticated user who is not a member of the private project could read the confidential issue’s title from the public merge request. This flaw is an information exposure through an insecure caching scheme, aligned with CWE‑524.

The vulnerability affects all GitLab Community Edition and Enterprise Edition releases from 15.0 up to, but not including, 19.3.6, 19.4.3, and 19.5.1. The fix is available in GitLab 19.3.6, 19.4.3, 19.5.1 and later, which correctly scope cache keys to individual users or remove the shared fragments entirely.

The CVSS base score of 3.5 denotes a low‑to‑moderate severity. EPSS is not available, implying a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need an authenticated GitLab account with the ability to create or view merge requests in a public project that reference a private issue; the exploitation path is via the web interface, remotely. The issue does not require elevated privileges on the private project, making any trusted user a potential attacker.