GitLab has a flaw that lets an authenticated user with developer role hide modifications from merge request diff views by exploiting how file names are processed. This does not provide code execution or system compromise but diminishes transparency of code changes, potentially enabling covert manipulation of project history and confusing reviewers. The weakness is classified as CWE‑639, an authorization bypass.

All GitLab Community and Enterprise editions from 15.9 up to, but not including, 18.10.8; from 18.11 up to, but not including, 18.11.5; and from 19.0 up to, but not including, 19.0.2 are impacted. Users should verify that they are running a patched version of these products.

The CVSS score of 3.7 indicates a low level of overall risk. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attacker must already be authenticating as a developer in a repository; therefore the attack vector is internal and requires appropriate repository permissions. Once the conditions are met, the developer can hide specific changes but cannot alter or delete code. The impact is limited to the visibility of changes, and it does not provide persistence or broader compromise. The unchanged ID encourages early remediation rather than waiting for a major vulnerability spike.