A missing authorization check in GitLab Enterprise Edition could allow an authenticated user with minimal access to read work item metadata from private projects. The vulnerability falls under CWE-862, indicating that an application failed to enforce appropriate access controls. As a result, confidential project information may be disclosed to unauthorized but logged‑in users, degrading confidentiality without affecting integrity or availability.

The issue affects GitLab EE versions starting from 18.9 up to (but not including) 18.11.7, 19.0 up to (but not including) 19.0.4, and 19.1 up to (but not including) 19.1.2. Any installation of GitLab EE within these version ranges that exposes work items is vulnerable.

The CVSS score of 4.3 indicates a low to moderate risk level. The EPSS score of < 1% suggests a very low but nonzero exploitation probability, and the vulnerability is not catalogued in CISA's KEV list. The attack requires an authenticated session with minimal privileges, meaning the threat is limited to users who have logged into the system. Consequently, while the risk is not critical, it remains significant enough to command remediation.