GitLab EE contained an authorization bypass vulnerability affecting versions >=18.6.0 <18.11.6, >=19.0.0 <19.0.3, and >=19.1.0 <19.1.1. Under certain conditions, authenticated users with limited permissions could access project information they should not have been authorized to view. This issue was addressed by GitLab in the fixed versions 18.11.6, 19.0.3, and 19.1.1.

The vulnerability could allow authenticated users with limited permissions to gain unauthorized access to project information. There are no known exploits in the wild, and the severity is rated low, indicating limited impact or difficulty of exploitation.

Upgrade GitLab EE to versions 18.11.6 or later if using the 18.6 branch, 19.0.3 or later if using the 19.0 branch, or 19.1.1 or later if using the 19.1 branch. These versions contain the official fixes for the missing authorization checks. No additional mitigation actions are indicated.