GitLab vulnerable to an authentication bypass that allows an authenticated user to read confidential issue content in public projects without proper authorization. The flaw originates from improper authorization checks and is classified as CWE-288. Attackers can exfiltrate sensitive information by exploiting this bypass, compromising confidentiality of issue data.

The affected product is GitLab Community and Enterprise Editions. Versions from 18.9.1 through 18.9.6, 18.10.0 through 18.10.5, and 18.11.0 through 18.11.2 are impacted. All lower versions of these releases are vulnerable.

The CVSS score of 6.5 indicates a medium severity with potential for data exposure. EPSS information is unavailable and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires the attacker to have valid credentials; the attacker can then use an alternate path or channel to access issue content that should be restricted. No requirement for remote network access beyond user authentication is specified in the description.