The vulnerability is an incorrect authorization check in GitLab's handling of work item requests, allowing an unauthenticated attacker to read the full contents of work items that belong to private groups and projects. This can expose sensitive metadata, notes, and other confidential information that should be restricted to authorized users, constituting unauthorized information disclosure.

GitLab Community Edition and Enterprise Edition releases starting at version 17.11 through the latest patch releases before the fix. Specifically, all versions from 17.11 up to before 19.2.8, every 19.3.x release before 19.3.6, and every 19.4.x release before 19.4.2 are impacted. Any installation—whether on‑premises or hosted in the cloud—could be affected if it runs an affected release.

The CVSS score of 5.3 places the issue in the moderate severity range. The EPSS score is less than 1%, indicating a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a network‑based request from an unauthenticated user who can reach the GitLab API or web interface; the attacker simply requests a work item and the system, due to the flawed authorization logic, returns the private data.