GitLab contains a missing authorization check in a merge‑request API endpoint that allows an authenticated user to bypass IP‑based access restrictions. When the conditions are met, the user can retrieve merge‑request information from private projects that they should not normally be able to see. The underlying weakness is a classic access‑control flaw (CWE‑862) and results in unauthorized disclosure of potentially sensitive project data, but it does not provide code execution or a full system compromise. The vulnerability is triggered only for users who already have valid credentials and is limited to read‑only data leakage.

This flaw affects GitLab Enterprise Edition, all releases from 12.0 up to (but not including) 19.0.6, all 19.1.x releases before 19.1.4, and all 19.2.x releases before 19.2.2. Users operating any of these versions should verify the specific build they are running and plan an upgrade to one of the supported releases.

The CVSS score of 4.3 indicates a medium severity threat. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation activity. Attackers would exploit the flaw by sending legitimate API requests to the merge‑request endpoint while authenticated, thereby evading IP restrictions and obtaining restricted data. Because the exploit requires only authenticated access and a properly configured API client, the risk to organizations with exposed or permissively configured GitLab instances is significant, especially for those storing highly sensitive or proprietary merge‑request information.