This vulnerability arises from an improper authorization check in GitLab’s handling of merge requests that reference confidential issues. An unauthenticated user who is able to access a publicly visible merge request could see the title of a confidential issue, leaking sensitive information. The vulnerability is a classic authorization design flaw (CWE-1230). The potential impact is loss of confidentiality, with no direct denial of service or code execution damage reflected.

The affected products are GitLab Community Edition and Enterprise Edition, covering all releases from 8.8 through 19.2 prior to the security fixes. The fix is available in GitLab 19.0.5, 19.1.3, 19.2.1 and later releases.

The reported CVSS score is 4.3, indicating a medium severity. The EPSS score of less than 1% suggests that the likelihood of exploitation in the wild is very low, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through the publicly accessible merge request URL, which does not require any authentication. The opportunity for exploitation is narrow and relies on the existence of a public merge request linked to a confidential issue.