In GitLab Enterprise Edition, an incorrect authorization flaw in DAST site profile management can let a user with a role expose stored DAST site profile secrets, representing a breach of confidentiality under the condition that the user can reach the profile management interface. The vulnerability maps to CWE-863, indicating a flaw in access control enforcement.

The issue affects GitLab versions starting from 13.11 up to (but not including) 18.11.6, 19.0, and 19.1 up to (but not including) 19.0.3 and 19.1.1. All products listed under the GitLab:GitLab vendor/product pair are impacted unless they have been patched to the newer releases.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, so the likelihood of exploitation is currently unknown. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be internal or internal network, requiring the attacker to possess a Developer role and access to the DAST site profile management functions; no remote execution or network-level entry is described.