GitLab Enterprise Edition versions from 18.4.0 up to but not including 18.4.4, and from 18.5.0 up to but not including 18.5.2, contained a vulnerability involving improper handling of URL encoding in repository references. This flaw could allow an authenticated user to obtain CSRF tokens by exploiting weaknesses in input validation combined with redirect handling. The issue has been remediated in versions 18.4.4 and 18.5.2.