The vulnerability stems from GitLab’s insufficient session expiration, allowing an attacker to use invalidated or incorrectly scoped credentials to log in to Virtual Registries. This flaw enables unauthorized access to registry contents and potentially exposes sensitive artifacts. The weakness follows CWE‑613, indicating a failure to properly enforce session lifetime, thus compromising the confidentiality of registry data.

GitLab Community and Enterprise Editions are affected. All releases from 18.2 through 18.9.5, 18.10 through 18.10.3, and 18.11 through 18.11.0 are vulnerable. These are the specific version ranges that must be checked before upgrading.

The CVSS score of 5.4 places this flaw in the moderate category, and the EPSS score is not available, suggesting no current public exploitation reports. It is not listed in the CISA KEV catalog. The most plausible attack path requires an attacker to obtain or compromise a user’s session token that has not yet expired; the flaw then allows that token to be reused, meaning that the exploit can be performed as a credential reuse attack. Because there is no remote code execution component, the impact is limited to unauthorized registry access, but the potential damage to data integrity and confidentiality is significant.