GitLab has a flaw in internal request handling that allows an authenticated user with a Developer role to unknowingly access sensitive information that should be protected by stricter access controls. The attacker can read data that falls outside the developer’s authorized scope, thereby creating a confidentiality breach. This vulnerability is identified as CWE-201, which relates to improper information exposure due to insecure handling of sensitive data.

GitLab Customer‑Edition and Enterprise‑Edition installations are affected. All versions starting with 10.1.0 up to, but not including, 19.0.5, the 19.1 series below 19.1.3, and the 19.2 series below 19.2.1 contain the flaw.

The vulnerability carries a high CVSS score of 8.5, indicating significant impact if exploited. The EPSS score of less than 1 % suggests that actual exploitation is currently rare, and the flaw is not registered in the CISA KEV catalog. Exploitation requires authentication as a Developer, implying the attack vector is an authenticated internal request that bypasses the intended access controls.