GitLab allows an authenticated developer to modify hidden merge requests due to incorrect authorization enforcement, exposing internal project changes to developers who should not have that capability. The vulnerability is an access-control weakness (CWE‑863) and can compromise the integrity of project histories. It does not directly expose sensitive data but affects project integrity and trust.

GitLab, including both Community Edition and Enterprise Edition, for all releases from 15.10 through 18.10.7, 18.11 through 18.11.4, and 19.0 through 19.0.1. Versions 18.10.8, 18.11.5, 19.0.2 and later contain the fix.

With a CVSS score of 5.4 the risk is moderate. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting that widespread exploitation is unlikely. The attack requires an authenticated user with developer permissions and no external network interaction, so internal users could abuse it if visibility controls are misconfigured.