The vulnerability arises from improper access control in GitLab CE/EE, allowing an unauthenticated user to download private debugging symbols from projects that should be inaccessible. This flaw permits the disclosure of potentially sensitive diagnostic data, such as stack traces or internal code references, without granting any direct code execution or privilege escalation capabilities.

GitLab CE and GitLab EE are impacted. All releases from 16.7 up to, but not including, version 18.9.7; from 18.10.0 to 18.10.5; and from 18.11.0 to 18.11.2 contain the flaw. Upgrading to any version 18.9.7, 18.10.6, 18.11.3, or later removes the vulnerability.

The CVSS score of 4.3 indicates a moderate risk level. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited exploitation evidence. The attack vector is inferred to involve unauthenticated HTTP requests to endpoints that expose debugging symbols; the attack can be performed by an adversary with network access to the GitLab instance, making exploitation straightforward once the vulnerable condition exists.