GitLab Enterprise Edition exposed a flaw in the Iterations API that could let an authenticated user query iteration data for private descendant groups. The problem stemmed from inadequate enforcement of group ownership checks, allowing a user with membership in a parent group to bypass permissions and read data that should remain inaccessible. This flaw is categorized as a CWE‑639 Authorization Bypass by User‑Controlled Key issue.

The vulnerability affected all GitLab EE releases from 16.7 up to 18.5 inclusive, and also includes 18.6.x versions earlier than 18.6.6, 18.7.x before 18.7.4, and 18.8.x before 18.8.4. Upgrading one of these versions to the patched releases (18.6.6, 18.7.4, or 18.8.4 or later) removes the flaw.

The CVSS score of 4.3 signals a moderate impact, and the EPSS score of less than 1 percent indicates a low probability of exploitation at this time. The vulnerability requires the attacker to be an authenticated user and to have some level of access to the parent group. While it does not provide an avenue for remote code execution or service disruption, it does allow unauthorized disclosure of sensitive project iteration information and could lead to broader privilege escalation if combined with other weaknesses. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been actively exploited in the wild.