GitLab has been found to allow an authenticated user to read confidential issue titles that were created in public projects under specific conditions due to improper removal of sensitive information before storage or transfer. The vulnerability is classified as CWE‑212, which involves handling sensitive data improperly. As a result, confidentiality of issue information can be compromised. The impact is that an attacker with valid user credentials could gain unauthorized access to confidential labels or titles that were intended to remain private.

All GitLab Community Edition and Enterprise Edition versions from 8.14 up to, but not including, 18.7.6, from 18.8 up to, but not including, 18.8.6, and from 18.9 up to, but not including, 18.9.2 are affected. This includes all community and enterprise releases listed in the supplied CPEs.

The CVSS score is 4.3, indicating moderate severity, while the EPSS score is below 1%, suggesting low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a legitimate authenticated session; no evidence of remote exploitation is provided in the description. Consequently, the risk is bounded to accounts that have legitimate access to GitLab, making the threat primarily significant within teams and organizations that use public projects with sensitive issue titles.