This vulnerability results from improper caching of authorization decisions in GitLab Enterprise Edition, which can enable an authenticated user to access resources they should not be able to view. The flaw is a missing authorization check and therefore compromises the integrity of the access control mechanisms, potentially exposing confidential data to unauthorized users.

GitLab Enterprise Edition, versions 18.1 through 18.10.0 that have not been updated to 18.8.7, 18.9.3 or 18.10.1 respectively.

The issue has a medium CVSS score of 3.7 and an EPSS score of less than 1, indicating a low likelihood of widespread exploitation. It is not listed in the CISA KEV catalog. The exploitation requires that the attacker has valid credentials and interacts with the system in a way that triggers the faulty caching logic, implying an authenticated attack vector. No additional public exploits have been reported as of the data available.