GitLab has addressed a critical information disclosure vulnerability in the CE and EE editions that allows authenticated users to access restricted data.

This vulnerability involves the improper insertion of sensitive information into sent data (CWE-201), which can be exploited by an authenticated attacker to gain unauthorized access to sensitive information.

This vulnerability is assigned a CVSS score of 8.5, indicating a high risk of sensitive data exposure. Unauthorized access to internal information within a development environment can lead to intellectual property theft, credential compromise, and severe reputational damage to the organization.

Immediate Action: Upgrade all instances of GitLab CE/EE to version 19.0.5, 19.1.3, 19.2.1, or higher immediately.

Proactive Monitoring: Audit access logs for unusual patterns of data retrieval or unexpected API calls originating from low privileged user accounts.

Compensating Controls: If immediate patching is not possible, restrict access to the GitLab instance to trusted internal networks and enforce strict session management policies.

Public Exploit Available: No

Organizations should treat this update with high priority due to the sensitive nature of the data stored within GitLab environments. Applying the provided updates is the most effective way to secure the environment against this information disclosure risk.