GitLab Community Edition and Enterprise Edition suffered a flaw where incorrect authorization checks could allow an authenticated user to view confidential details on issues. The vulnerability could expose sensitive project data to users who should not have access, thereby breaching confidentiality of internal information.

All GitLab versions from 12.0 up to but not including 18.10.8, from 18.11 up to but not including 18.11.5, and from 19.0 up to but not including 19.0.2 are affected. The recommendation is to upgrade to GitLab 18.10.8, 18.11.5, 19.0.2 or later.

The CVSS score of 3.1 indicates a low severity rating. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is an authenticated user exploiting the flawed permission checks; no external or privileged execution is required.