A flaw in the authorization logic of GitLab Enterprise Edition permits an authenticated user assigned the auditor role to edit vulnerability flag data for private projects. This bypass undermines data integrity, allowing auditors to hide or mislabel vulnerabilities, which can delay remediation and distort security reporting. The issue is identified as an authorization bypass.

Users running GitLab Enterprise Edition versions from 18.6 up to before 18.8.9, from 18.9 up to before 18.9.5, and from 18.10 up to before 18.10.3 are affected. The vulnerability is resolved in releases 18.8.9, 18.9.5, 18.10.3 and later.

The vulnerability has a CVSS score of 4.3, indicating moderate severity. Exploitation requires an authenticated auditor with access to the private project, and no remote code execution or arbitrary data access is available. The likelihood of exploitation appears low, as reflected by a minimal probability and absence from major exploitation catalogs.