GitLab introduced a vulnerability that permits an authenticated user to read or modify another group's virtual registry cleanup policy settings. The flaw corresponds to CWE-639 and carries a CVSS score of 5.4, indicating a moderate risk that is confined to configuration data rather than system compromise.

The flaw affects GitLab Enterprise Edition versions 18.6 through 18.11.5, 19.0 through 19.0.2, and 19.1 through 19.1.0. Affected vendors include GitLab. Any environment running these versions should be considered vulnerable.

The vulnerability is exploitable by users who already possess valid login credentials; exploitation occurs entirely within the GitLab application and does not require additional privileges or remote code execution. Based on the description, it is inferred that the attack path involves authenticated users modifying registry cleanup policy settings. Because the EPSS score is not available and the issue is not listed in CISA KEV, the likelihood of widespread use appears low for now, but the impact on policy integrity warrants precautionary action.