Private-content disclosure via incorrect hierarchy authorization

Authorization bypass in GitLab CE/EE GraphQL allows remote attackers to read private work item contents through hierarchy queries. The GraphQL work item hierarchy applies incorrect authorization checks to private group and project contents; the exact faulty resolver is undisclosed. Exploitation requires no authentication, but the vendor has not specified the necessary request conditions; the documented consequence is reading contents, not modifying them.