GitLab’s security engine had a flaw that let an authenticated auditor – a role typically granted limited visibility – alter vulnerability flag data within private projects. The change would allow the user to flip or delete flags that indicate whether a vulnerability is present, effectively tampering with the integrity of security reporting. The defect arises from an incorrect authorization check that bypasses the expected privilege level for modifying such flags.

The issue affects all GitLab Enterprise Edition installations from version 18.6 up through just before the fixes in 18.8.9, 18.9.5 and 18.10.3. Any site running one of those E3 or E5 versions with private projects and auditor users is eligible to be impacted. Applying the vendor‑issued patches raises the software to 18.8.9 or later and removes the vulnerability.

The CVSS score of 4.3 indicates a low severity rating, and the vulnerability has not been identified in the CISA Known Exploited Vulnerabilities catalog. Because it requires a legitimate auditor account and access to a private project, the likelihood of exploitation is limited to de‑identified or compromised accounts, not to arbitrary external attackers. Nevertheless, auditors with mis‑configurations may unintentionally affect the visibility of project security data. The attacker must acquire or elevate an existing auditor credential; once in place, the flaw allows defeat of the normal authorization barrier without additional prerequisites.