GitLab Community Edition and Enterprise Edition versions earlier than 18.10.7, 18.11.4, or 19.0.1 contain an incorrect authorization check that could allow an unauthorized user to enumerate private projects. This weakness, classified as CWE‑863, permits the unintended disclosure of project metadata and the existence of private resources, potentially aiding an attacker by revealing the organization’s repository landscape for future targeting.

All GitLab CE/EE installations running a version older than 18.10.7, 18.11.4, or 19.0.1 are affected, including any deployment that has not yet been updated to the patched releases.

The CVSS score of 5.3 indicates moderate severity, but the EPSS score is not available, so current exploitation likelihood cannot be accurately assessed. The vulnerability is not listed in CISA KEV. Attackers who can reach the GitLab instance over the network do not require special credentials; they can trigger the flawed authorization check by sending crafted requests, leading to the enumeration of private projects.