GitLab EE: authenticated user bypasses IP access restrictions to read private merge request data

Impact

A merge requests API endpoint misses authorization checks, letting an authenticated user read limited merge request information from a private project while bypassing the group's IP-based access restriction. IP allowlisting is the compensating control operators lean on to keep a self-managed GitLab reachable only from management networks or a VPN, so the practical loss here is that the network boundary does not hold on this API path. The data exposed is limited merge request metadata - GitLab scores confidentiality low with no integrity or availability impact. Affects 12.0 before 19.0.6, 19.1 before 19.1.4 and 19.2 before 19.2.2.

Who can reach it

An authenticated GitLab user with network reach to the instance API, calling from an address the group's IP restriction should have blocked. No elevated project role is described.

What to do

Upgrade to 19.0.6, 19.1.4 or 19.2.2 per the GitLab 19.2.2 patch release - a package upgrade and service restart (Omnibus reconfigure/restart or a Helm chart bump), with a short GitLab outage and no fleet impact. Until then, do not treat group IP restrictions as the only boundary in front of the instance; enforce the same restriction at the load balancer or ingress.

References