GitLab includes a flaw where unauthorized users can read confidential notes on public projects because of incorrect authorization checks. This flaw enables a confidentiality breach, potentially exposing private information without authentication. The weakness is identified as CWE-863, Incorrect Authorization.

The vulnerability impacts GitLab Community and Enterprise Editions from version 17.4 up through early 19.x releases: all 19.0, 19.1, up to 19.2.7; 19.3.0 through 19.3.4; and 19.4.0 through 19.4.1. The fix is incorporated in GitLab version 19.2.8, 19.3.5, 19.4.2 and later.

The CVSS score of 5.3 indicates moderate risk; exploit probability data is not available and the vulnerability is not part of CISA KEV. The attacker can exploit the issue by accessing public projects without authentication, reading confidential notes. Based on the description, the likely attack vector is unauthenticated network access to the GitLab instance.