GitLab EE versions from 12.0 up to but not including 19.0.6, 19.1 up to but not including 19.1.4, and 19.2 up to but not including 19.2.2 contained a missing authorization check in a merge requests API endpoint. Under certain conditions, this flaw allowed authenticated users to bypass IP-based access restrictions and read limited merge request data from private projects. The issue was addressed by GitLab in the specified fixed versions.

Authenticated users could bypass IP-based access restrictions designed to protect private project merge request information, potentially exposing limited sensitive data. There is no indication of remote unauthenticated exploitation or broader privilege escalation. No known exploits in the wild have been reported.

Apply the official patches provided by GitLab by upgrading to versions 19.0.6 or later for the 19.0 branch, 19.1.4 or later for the 19.1 branch, and 19.2.2 or later for the 19.2 branch. Since patchAvailable is true and fixed versions are identified, remediation should be performed promptly to address the vulnerability.