GitLab Enterprise Edition contains an error in the cleanup logic that triggers when a thrown exception occurs during vulnerability record handling. The flaw does not differentiate between existing vulnerability entries and newly created entries, allowing an authenticated user who only has read‑only permissions to permanently delete existing records. The primary consequence is loss of stored vulnerability data, which can impair audit trails and security oversight.

All GitLab Enterprise Edition releases from 17.8 through 19.2, as well as 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 are affected. The issue does not apply to versions 19.3.6, 19.4.3, 19.5.1 or newer. Affected installations are those that enable the vulnerability tracking feature and have users with read‑only access.

The flaw is considered low severity with a CVSS score of 3.1. Because the attacker role required is a legitimate, read‑only user, the attack surface is limited to authenticated accounts that already exist in the system. No remote code execution or privilege escalation is possible. The event is not listed in CISA’s KEV catalog and no EPSS data is available, suggesting that exploit activity has not been observed. Nonetheless, the data loss risk warrants attention due to its impact on compliance and visibility.