GitLab introduced an insufficient scope enforcement on a GraphQL field that can be abused by an authenticated user holding a read_api-scoped token. The flaw allows such a user to retrieve a project's incoming email address and to create work items, effectively bypassing the intended restrictions of the token. This is an authorization bypass that can expose project email addresses and permits unauthorized creation of work items, potentially compromising confidentiality and integrity.

GitLab Community Edition and Enterprise Edition, all releases from 18.2 up to but not including 19.3.6, from 19.4 up to but not including 19.4.3, and from 19.5 up to but not including 19.5.1.

The CVSS score of 6.8 indicates a moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation at present. The likely attack vector is through the GraphQL API, which can be accessed remotely by an authenticated user with read_api privileges. Exploitation requires that the user possess a valid read_api token; the flaw does not require elevated privileges beyond those granted by that token.