GitLab Enterprise Edition contains an improper access control flaw that allows unauthenticated remote users to retrieve API tokens tied to self‑hosted AI models. The affected endpoint does not enforce authentication, enabling a malicious actor to read tokens that grant privileged interactions with the AI service. This flaw aligns with CWE‑306 and poses a risk of credential theft, potential data exfiltration, or unauthorized manipulation of the AI model's behavior.

GitLab Enterprise Edition versions 18.5 through 18.8.6, all 18.9 releases prior to 18.9.3, and all 18.10 releases prior to 18.10.1 are vulnerable. Any installation of these versions that exposes the vulnerable API endpoint to the network is susceptible to exploitation.

The vulnerability has a CVSS score of 6.8, indicating moderate severity, and an EPSS score of less than 1 %, suggesting low current exploit probability. It is not listed in CISA's KEV catalog. Exploitation can occur over public or internal network connections that reach the GitLab instance; an unauthenticated HTTP request to the vulnerable API endpoint can reveal token values. Once obtained, the tokens can be used to perform privileged operations against the associated AI models, compromising confidentiality, integrity, or potentially enabling code execution depending on the model's capabilities.