Use of Ruby Forwardable module and runtime meta-programming may introduce vulnerabilities #874401 Informative Information Disclosure – 2021-11-15 – 2 Confidential issues leaked in public projects when attached to milestone #134300 Valid Information Disclosure – 2016-05-03 – 5 Guests Will Disclose the Private Project Full Activity Via Project Activity Feeds #491319 N/A Information Disclosure – 2019-02-08 – 5 Project Milestones Disclosed Via Groups When the Victim disabled milestones access in project settings #636560 Valid Information Disclosure – 2019-12-13 – 5 GFM renderer leaks external issue tracker URL of private project #133717 Valid Information Disclosure – 2017-06-08 – 6 Labels created in private projects are leaked #132777 Valid Information Disclosure – 2016-05-03 – 7 Private snippets in public / internal projects leaked though GitLab API #134305 Valid Information Disclosure – 2016-05-03 – 7 Todos are not redacted when membership changes - Access to (confidential) issues and merge requests #880863 Valid Information Disclosure – 2020-11-02 – 7 Responsible Disclosure of Privacy Leakage Issue #1089914 Informative Information Disclosure – 2021-06-29 – 7 Path paths and file disclosure vulnerabilities at influxdb.quality.gitlab.net #1643962 Valid Information Disclosure – 2022-11-04 – 8 Unauthorized user is able to access schedule pipeline variables and values #962462 Valid Information Disclosure – 2020-11-30 – 9 Attacker can extract list of private project's project members #128051 Valid Information Disclosure – 2016-08-01 – 10 Boards leak private label names and desciptions #162147 Valid Information Disclosure – 2016-09-02 – 10 Users can download old project exports due to unclaimed namespace #195058 Valid Information Disclosure – 2017-01-23 – 10 SSRF when importing a project from a git repo by URL #135937 Valid Information Disclosure – 2018-05-29 – 12 GraphQL Query leads to sensitive information disclosure #985124 Duplicate Information Disclosure – 2021-03-08 – 12 [information disclosure] Validate existence of a private project. #605608 Valid Information Disclosure – 2021-03-09 – 14 Private System Note Disclosure using GraphQL #633001 Valid Information Disclosure – 2019-12-13 – 17 Race condition in GitLab import, giving access to other people their imports due to filename collision #214028 Valid Information Disclosure – 2017-10-03 – 22 Unauthorized users may be able to view almost all informations related to Private projects. #407763 Valid Information Disclosure – 2018-12-03 – 24 Last build status and coverage leaked to unauthorized users #477222 Valid Information Disclosure – 2019-09-01 – 24 Unauthorized access to private project security dashboard #853355 Valid Information Disclosure – 2020-11-21 – 24 Able to leak private email of any user given his/her username via graphql #972355 Valid Information Disclosure – 2021-01-08 – 29 Maintainer can leak sentry token by changing the configured URL (fix bypass) #2104591 Valid Information Disclosure Medium 2024-10-08 – 32 EXIF metadata not stripped from JPG group logos #446238 Valid Information Disclosure – 2020-09-08 $500 55 Know whether private project name exists or not within a group using link comments #495497 Valid Information Disclosure – 2019-10-07 – 58 Able to view hackerone reports attachments #979787 Valid Information Disclosure – 2022-07-11 – 103 Read files on application server, leads to RCE #178152 Valid Information Disclosure – 2016-11-03 – 114 information disclosure of secret_key_base via encoding charcters #460545 Valid Information Disclosure – 2019-06-13 $3,500 146 Snippet JS template allows attacker to read a user's private snippets #348443 Valid Information Disclosure – 2019-03-03 $300 165 JSON serialization of any Project model results in all Runner tokens being exposed through Quick Actions Analysed #509924 Valid Information Disclosure – 2019-04-20 $12,000 366 gitlab-workhorse bypass in Gitlab::Middleware::Multipart allowing files in `allowed_paths` to be read Analysed #850447 Valid Information Disclosure – 2020-06-08 $10,000 410