An unauthorized user can read internal notes and confidential system notes on public projects through GitLab’s GraphQL API, due to improper authorization enforcement. flaw allows extraction of sensitive information that should be protected by project permissions and is classified as a CWE-863 issue. The data exposed includes notes that may contain operational details, vulnerability information, or personal information, compromising confidentiality.

GitLab Community and Enterprise Editions are affected. All releases from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 are vulnerable. The vulnerability has been fixed in GitLab 19.2.8, 19.3.5, 19.4.2 and later versions.

The vulnerability carries a CVSS score of 5.3, indicating a moderate severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, suggesting limited evidence of exploitation in the wild to date. Attackers can exploit the flaw remotely by sending crafted GraphQL queries to the public API endpoint without needing to authenticate, and can retrieve internal notes from any publicly exposed project. No special prerequisites beyond network access to the GitLab instance are required, making the attack surface broad.