GitLab CE/EE suffered an access‑control flaw where the system performed the access‑control check only after the package asset was fetched. An authenticated user with a developer role could therefore read or modify protected package content, effectively bypassing the protection rules assigned to those packages. The weakness is a CWE‑1280: Inadequate Access Control. This allows the developer to gain privileges beyond the intended protection boundaries, risking confidentiality and integrity of package artifacts but not executing arbitrary code or causing denial of service.

All GitLab Continuous Integration and package hosting versions from 18.3 up to, but not including, 18.9.7, from 18.10 up to, but not including, 18.10.6, and from 18.11 up to, but not including, 18.11.3. Both Community Edition and Enterprise Edition are affected.

The CVSS score of 4.3 indicates a moderate impact. EPSS is not available, so exploitation probability is unclear, and the vulnerability is not listed as a known exploited vulnerability in CISA's KEV catalog. The vulnerability can be exploited only by authenticated users who have a developer role in a project, making the attack vector internal to the organization. Once authenticated, the attacker can read or modify protected package payloads as if having higher privileges, potentially allowing further compromise of downstream systems that consume those packages.