GitLab’s authorization logic incorrectly allows an unauthenticated user to retrieve confidential issue references from public projects. This flaw enables an attacker to view sensitive issue metadata that should be protected, such as issue identifiers, titles, or hidden references, exposing confidential information. The weakness is identified as CWE‑862: Missing Authorization.

GitLab Community or Enterprise Edition installations built before version 18.11.6, before 19.0.3, or before 19.1.1 are impacted. All releases in the ranges 17.5 through 18.11.5, 19.0.0 to 19.0.2, and 19.1.0 are vulnerable. The issue applies to the web interface and API of GitLab.

The CVSS score of 5.3 signals moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited publicly known exploitation. The attack requires unauthenticated HTTP access to a GitLab instance; an attacker can send a normal request to a public project’s issue endpoint and receive hidden reference data. The combination of moderate severity and straightforward delivery vector indicates that the vulnerability is actionable and should be addressed promptly.