This vulnerability is an authorization flaw (CWE-863) that could let an attacker retrieve package files from a public GitLab project. The flaw arises because GitLab does not correctly enforce permission checks when a download request is made for a package in a shared project. If exploited, an attacker could obtain source artifacts that may contain sensitive code, configuration, or build data. The impact is primarily a confidentiality breach; integrity or availability are not directly affected as the flaw allows read access only. The impact scope is limited to public projects and does not grant escalation beyond the level of access normally granted to a user who can view the project.

The affected product is GitLab Community Edition and Enterprise Edition. All releases from 15.1 up through versions just before 19.2.8, 19.3.5, and 19.4.2 are vulnerable. That includes 15.1 through 19.1.x, the 19.2 series up to 19.2.7, the 19.3 series up to 19.3.4, and the 19.4 series up to 19.4.1. Users running these versions should upgrade to v19.2.8, v19.3.5, v19.4.2, or any later release that contains the fix.

The CVSS score of 4.2 indicates a low severity vulnerability. EPSS is not available, and the issue is not listed in CISA KEV, suggesting that widespread exploitation is not currently documented. The likely attack vector is remote, as the flaw can be triggered by sending a download request to a public GitLab repository from any network with access to the instance. An authenticated or unauthenticated user could exploit the missing authorization check to download a package file. Because the flaw only allows read access to project packages, the overall risk to system integrity and availability is low, but confidentiality could be compromised for sensitive artifacts in public projects.