GitLab CE and EE suffered from an authorization flaw that allowed an authenticated user with Reporter-level group permissions to view package metadata from projects where the Package Registry feature was disabled. This is a misuse of access control and can expose metadata that is not intended to be publicly visible, potentially aiding attackers in gathering information about project contents. The weakness corresponds to CWE‑863: Improper Authorization.

All GitLab CE/EEs from versions 13.6 up to but not including 18.11.6, 19.0.0 up to but not including 19.0.3, and 19.1.0 up to but not including 19.1.1 are vulnerable. These are all supported GitLab releases listed under the GitLab:GitLab product family.

The CVSS base score of 4.3 indicates a medium impact. An attacker needs to be authenticated and possess at least Reporter privileges in a group that has a project with the Package Registry disabled, which limits the exploitation surface compared with higher‑privilege attacks. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a low to moderate likelihood of exploitation at present. The most likely attack vector is an internal or partially privileged user exploiting the access check to gather metadata information.