GitLab CE/EE versions ranging from 15.10 through the latest minor releases before 19.3.6, 19.4.3, and 19.5.1 contain a missing authorization check that allows an authenticated user to read milestone metadata—including titles, descriptions, and full project paths—from any private project across the instance without having project membership. The flaw is an example of CWE‑639, an Access Control Vulnerability, and results in a confidentiality breach by exposing sensitive project information to users who should not have access.

All GitLab Community Edition and Enterprise Edition releases starting at version 15.10 and including forward‑compatible 19.x releases up to but excluding 19.3.6, 19.4.3, and 19.5.1 are affected. Users running any of these versions should verify whether they fall into that range and plan an upgrade accordingly.

The vulnerability has a CVSS score of 4.3, indicating moderate severity. Because exploitation requires an authenticated user, the likelihood of an attacker who is already logged in to the instance gaining unauthorized data is significant, yet it does not enable arbitrary code execution or compromise. The EPSS score is not available and the issue is not currently listed in CISA’s KEV catalog. In practice, the attack vector is a legitimate user interface: an authenticated account can send a request to the group milestones API with a user‑supplied project filter, and the system will return milestone information from private projects the user has no membership rights for.