The vulnerability originates from missing authorization checks in the CSV export endpoint for issues. An authenticated user can trigger the export and retrieve issue data that includes confidential information tied to other users. This flaw results in unauthorized disclosure of sensitive issue content, a breach of confidentiality, and is characterized as an authorization bypass (CWE‑639). No compromise of integrity or availability is directly described.

GitLab Community Edition and Enterprise Edition releases from 18.2 up to before 18.8.9, from 18.9 up to before 18.9.5, and from 18.10 up to before 18.10.3 are vulnerable. Deployments running any of those versions are at risk.

The CVSS base score of 4.3 indicates moderate severity. Exploit probability is not provided by EPSS, and the flaw does not appear in the CISA KEV catalog. An attacker must first authenticate to the GitLab instance to use the CSV export feature, so the potential vector is internal or compromised accounts. If successful, the attacker can drain confidential issue data, but no full system compromise is described.