GitLab Enterprise Edition possesses an improper authorization check that can allow an authenticated user with developer role permissions to view sensitive deployment data on projects. This flaw does not give remote code execution or denial of service but permits unauthorized disclosure of deployment information, compromising confidentiality of project infrastructure settings or configuration details.

GitLab EE versions before 18.10.7, before 18.11.4, and before 19.0.1 are affected. The vulnerability applies to all releases from 11.5 to these cut‑off points where the authorization logic is deficient.

The CVSS score is 4.3, indicating low to moderate severity. EPSS is currently unavailable, so the likelihood of exploitation in the wild cannot be quantified but is presumably low without public exploitation data. The vulnerability is not listed in CISA KEV. An attacker would need to be an authenticated developer on a GitLab instance to benefit from the flaw, suggesting the attack vector is authenticated and role‑based.