A vulnerability in GitLab CE/EE versions from 13.7 up to 18.2.8, versions 18.3 before 18.3.4, and versions 18.4 before 18.4.2 allowed authenticated users without project membership to view sensitive manual CI/CD variables via the GraphQL API. This issue has been remediated by GitLab.