GitLab contains an improper access control flaw that allows an authenticated user to view the titles of confidential or private issues in projects that are publicly visible. This weakness is a classic example of incorrect authorization, classified as CWE‑863. The consequence is the disclosure of internal project tagging information that may give attackers insight into repository structure, project status, or potential targets, thereby leaking sensitive business logic and planning details.

GitLab CE and EE, all releases earlier than 18.11.1 but from version 18.11 onward. The vulnerability affects all installations running these releases regardless of configuration, including the community and enterprise editions.

The CVSS base score of 4.3 indicates a medium impact. Exploitation requires only that the attacker be an authenticated user with access to a public project. Attackers can then craft requests to the issue rendering service and observe the titles of confidential issues. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog at this time, so the risk is governed mainly by the medium CVSS score and the likelihood of privileged access to the affected GitLab instance.