GitLab CE/EE allowed an authenticated user to export issues as CSV. Because authorization checks were insufficient, the export revealed confidential issues assigned to other users, giving unauthorized access to sensitive issue data. This is an authorization bypass that compromises confidentiality of issue contents.

The vulnerability affects all GitLab Community and Enterprise Edition releases from version 18.2 up to, but excluding, patches 18.8.9, 18.9.5, and 18.10.3. Any deployment of these versions, whether community or enterprise, is susceptible.

The CVSS score is 4.3, indicating moderate impact. EPSS is below 1%, suggesting low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog. Exploitation requires an authenticated account and the use of the CSV export function; thus the attack vector is a legitimate user. Because of the moderate CVSS and low EPSS, the overall risk is moderate but administrators should still patch promptly.