GitLab’s integration with Jira mistakenly used a project filter only as a display control, failing to restrict the API token’s real access. Consequently, an authenticated user could view Jira issues outside the intended projects, exposing potentially sensitive information. This is a classic confused‑deputy flaw that allows a party with some legitimate access to leverage a feature for unauthorized actions.

GitLab Community Edition and Enterprise Edition from version 13.7 up to, but not including, 18.9.7; versions 18.10.0 through 18.10.5; and versions 18.11.0 through 18.11.2 are affected. All earlier and these pre‑patch series are vulnerable.

The vulnerability is rated with a CVSS score of 5.8 and currently has no EPSS data, indicating limited publicly available exploitation evidence. It is not listed in the CISA KEV catalog. Because the issue requires an authenticated user, the attack vector is typically internal; any user who can use the Jira integration can exploit the flaw without additional privileges.