Its report describes the issue as potentially allowing unauthenticated remote code execution, meaning an attacker would not need to log in before attempting execution.
The publication says the exposure could span roughly 12 years of GitLab releases. Its operational guidance is to match a deployment to the applicable patched versions and update the installation. The report frames this as patch guidance for organizations running their own GitLab deployments.
The supplied report does not provide a CVE identifier, affected-version ranges, patched-version numbers, technical root cause, or evidence of exploitation in the wild. It therefore does not establish whether any particular GitLab deployment is vulnerable, which release an operator should install, or whether a public exploit exists. Operators need GitLab's own advisory material to make those determinations.