GitLab EE contained an authorization flaw in specific versions that could permit an authenticated user with maintainer permissions to retrieve stored credentials of other users. The affected versions include all from 9.5 up to but not including 18.11.7, 19.0 up to but not including 19.0.4, and 19.1 up to but not including 19.1.2. This vulnerability arises from improper authorization checks allowing credential disclosure. The issue is remediated in the stated fixed versions. The Ubuntu packages 8.4.3+dfsg-9, 8.4.3+dfsg-12, and 8.5.8+dfsg-5 are also affected. There is no indication of known exploits in the wild.

An authenticated user with maintainer-level permissions could obtain another user's stored credentials, leading to a confidentiality breach. There is no impact on system integrity or availability. This could facilitate unauthorized access or lateral movement if exploited.

Fixed versions are available: 18.11.7 or later for the 9.5 series, 19.0.4 or later for the 19.0 series, and 19.1.2 or later for the 19.1 series. Users should upgrade to these versions to remediate the vulnerability. No vendor advisory was provided, so patch status is inferred from the description. Patch status is not yet confirmed by vendor advisory — check official GitLab and Ubuntu advisories for current remediation guidance.