GitLab suffered a missing authorization check on linked work items within visible epics, enabling an authenticated user to read private child issue titles and descriptions from projects they did not have access to. This flaw can expose internal project information, compromising confidentiality and potentially revealing sensitive business details. The weakness is identified as a missing authorization flaw.

Vendors: GitLab; Product: GitLab. Affected versions are all releases from 19.0 up to but not including 19.2.7, from 19.3 up to but not including 19.3.3, and from 19.4 up to but not including 19.4.1. Users of any of these releases should verify their version and upgrade if necessary.

The CVSS base score is 4.3 and the EPSS score is below 1%, indicating a moderate severity but very low probability of exploitation. The flaw requires that the attacker first authenticates to the GitLab instance and that an epic containing linked child issues is visible to them; under those conditions the missing check allows read access to the private data. The vulnerability is not listed in the CISA KEV catalog.