gitlab-workhorse bypass in Gitlab::Middleware::Multipart allowing files in `allowed_paths` to be read Analysed #850447 Valid Information Disclosure Critical 2020-06-08 $10,000 410 JSON serialization of any Project model results in all Runner tokens being exposed through Quick Actions Analysed #509924 Valid Information Disclosure Critical 2019-04-20 $12,000 366 Snippet JS template allows attacker to read a user's private snippets Analysed #348443 Valid Information Disclosure Low 2019-03-03 $300 165 information disclosure of secret_key_base via encoding charcters Analysed #460545 Valid Information Disclosure High 2019-06-13 $3,500 146 Read files on application server, leads to RCE Analysed #178152 Valid Information Disclosure Critical 2016-11-03 – 114 Able to view hackerone reports attachments Analysed #979787 Valid Information Disclosure Critical 2022-07-11 – 103 Know whether private project name exists or not within a group using link comments Analysed #495497 Valid Information Disclosure Low 2019-10-07 – 58 EXIF metadata not stripped from JPG group logos Analysed #446238 Valid Information Disclosure Low 2020-09-08 $500 55 Maintainer can leak sentry token by changing the configured URL (fix bypass) #2104591 Valid Information Disclosure Medium 2024-10-08 – 32 Able to leak private email of any user given his/her username via graphql #972355 Valid Information Disclosure Medium 2021-01-08 – 29 Unauthorized access to private project security dashboard #853355 Valid Information Disclosure Medium 2020-11-21 – 24 Last build status and coverage leaked to unauthorized users #477222 Valid Information Disclosure Low 2019-09-01 – 24 Unauthorized users may be able to view almost all informations related to Private projects. #407763 Valid Information Disclosure Medium 2018-12-03 – 24 Race condition in GitLab import, giving access to other people their imports due to filename collision #214028 Valid Information Disclosure Low 2017-10-03 – 22 Private System Note Disclosure using GraphQL #633001 Valid Information Disclosure Low 2019-12-13 – 17 [information disclosure] Validate existence of a private project. #605608 Valid Information Disclosure Low 2021-03-09 – 14 SSRF when importing a project from a git repo by URL #135937 Valid Information Disclosure – 2018-05-29 – 12 Users can download old project exports due to unclaimed namespace #195058 Valid Information Disclosure Medium 2017-01-23 – 10 Boards leak private label names and desciptions #162147 Valid Information Disclosure – 2016-09-02 – 10 Attacker can extract list of private project's project members #128051 Valid Information Disclosure – 2016-08-01 – 10 Unauthorized user is able to access schedule pipeline variables and values #962462 Valid Information Disclosure High 2020-11-30 – 9 Path paths and file disclosure vulnerabilities at influxdb.quality.gitlab.net #1643962 Valid Information Disclosure Low 2022-11-04 – 8 Todos are not redacted when membership changes - Access to (confidential) issues and merge requests #880863 Valid Information Disclosure Medium 2020-11-02 – 7 Private snippets in public / internal projects leaked though GitLab API #134305 Valid Information Disclosure – 2016-05-03 – 7 Labels created in private projects are leaked #132777 Valid Information Disclosure – 2016-05-03 – 7 GFM renderer leaks external issue tracker URL of private project #133717 Valid Information Disclosure – 2017-06-08 – 6 Project Milestones Disclosed Via Groups When the Victim disabled milestones access in project settings #636560 Valid Information Disclosure Low 2019-12-13 – 5 Confidential issues leaked in public projects when attached to milestone #134300 Valid Information Disclosure – 2016-05-03 – 5