GitLab EE: GraphQL query exposes policy configuration from an unauthorized namespace

Impact

Incorrect authorization checks in a GraphQL query let an authenticated user read policy configuration belonging to a namespace they have no access to. On a self-managed GitLab that gates what reaches the fleet, those policies describe the scanning and approval rules a change must pass, so the exposure tells an attacker with a foothold account which controls exist and where they are weakest. It is read-only - GitLab scores confidentiality low with no integrity or availability impact - and no configuration change is described. Affects 19.1 before 19.1.4 and 19.2 before 19.2.2.

Who can reach it

Any authenticated GitLab user who can issue GraphQL queries against the instance. No membership in the target namespace and no elevated role is required.

What to do

Upgrade to 19.1.4 or 19.2.2 per the GitLab 19.2.2 patch release - a package upgrade and service restart (Omnibus reconfigure/restart or a Helm chart bump), with a short GitLab outage and no GPU node impact.

References