GitLab has an authorization flaw that can allow a user with Guest access to read confidential epic content that should be protected. The vulnerability is caused by improper checks against external authorization rules, leading to data disclosure of restricted information.

Affected versions of GitLab Community Edition and Enterprise Edition start with 17.0 up to but not including 19.2.8, 19.3 up to but not including 19.3.5, and 19.4 up to but not including 19.4.2. Any instance running these versions may be susceptible.

The CVSS score of 4.3 indicates a moderate severity. The issue requires an authenticated Guest role and specific conditions, making exploitation less likely in the wild; EPSS information is not available and the vulnerability is not in the CISA KEV catalog. An attacker with legitimate access as Guest could read confidential data, but the impact is limited to information disclosure rather than system compromise.