Exfiltrate and mutate repository and project data through injected templated service Analysed #446585 Valid Access Control Critical 2019-03-05 $11,000 762 Project Template functionality can be used to copy private project data, such as repository, confidential issues, snippets, and merge requests Analysed #689314 Valid Access Control Critical 2019-11-27 $12,000 457 gitlab-workhorse bypass in Gitlab::Middleware::Multipart allowing files in `allowed_paths` to be read Analysed #850447 Valid Information Disclosure Critical 2020-06-08 $10,000 410 JSON serialization of any Project model results in all Runner tokens being exposed through Quick Actions Analysed #509924 Valid Information Disclosure Critical 2019-04-20 $12,000 366 Attacker is able to access commit title and team member comments which are supposed to be private Analysed #502593 Valid Access Control High 2019-07-03 – 351 Group search leaks private MRs, code, commits Analysed #692252 Valid Access Control High 2019-12-14 – 212 Snippet JS template allows attacker to read a user's private snippets Analysed #348443 Valid Information Disclosure Low 2019-03-03 $300 165 IDOR Exposes All Machine Learning Models Analysed #2528293 Valid Insecure Direct Object Reference Medium 2024-10-01 $1,160 117 Able to view hackerone reports attachments Analysed #979787 Valid Information Disclosure Critical 2022-07-11 – 103 Group search with Elastic search enable leaks unrelated data Analysed #708820 Valid Access Control High 2019-12-14 – 100 RepositoryPipeline allows importing of local git repos Analysed #1685822 Valid Access Control Medium 2022-11-04 $22,300 89 GraphQL query "namespace" leaks data Analysed #614355 Valid Access Control Medium 2019-12-03 – 64 Change project visibility to a restricted option Analysed #1086781 Valid Misconfiguration and Insecure Design Medium 2021-12-30 $1,370 51 Improper access control for users with expired password, giving the user full access through API and Git Analysed #1285226 Valid Access Control Medium 2022-01-27 – 49 View the Starred Projects in a Private Profile Analysed #703894 Valid Insecure Direct Object Reference Low 2021-02-02 $500 49 A deactivated user can access data through GraphQL Analysed #1192460 Valid Access Control Medium 2021-08-30 – 47 Milestones leaked via search API Analysed #460815 Valid Access Control Low 2019-07-19 – 43 Kroki Arbitrary File Read/Write Analysed #1098793 Valid Access Control High 2021-05-21 $5,600 41 Bypassing push rules via MRs created by Email Analysed #526570 Valid Access Control Medium 2019-10-01 – 36 Remote hacker can download all the files of master branch in public projects where everything is members only. Analysed #1043480 Valid Authentication Medium 2021-02-15 – 31 Mailgun misconfiguration leads to email snooping and postmaster@-access on email.mg.gitlab.com Analysed #174983 Valid Access Control – 2016-12-06 – 31 Attacker is able to create,Edit & delete notes and leak the title of a victim's private personal snippet Analysed #1751258 Valid Insecure Direct Object Reference Medium 2023-06-02 $1,730 29 Guest Users can create issues for Sentry errors and track their status Analysed #1117768 Valid Access Control Low 2021-09-24 $610 29 Able to leak private email of any user given his/her username via graphql Analysed #972355 Valid Information Disclosure Medium 2021-01-08 – 29 Access Projects And create projects in gitlab pre production server Analysed #540711 Valid Access Control Low 2019-08-28 – 28 Add and Access to Labels of any Private Projects/Groups of Gitlab(IDOR) Analysed #439729 Valid Insecure Direct Object Reference Low 2019-09-19 – 27 Stealing data from customers.gitlab.com without user interaction Analysed #674195 Valid Insecure Direct Object Reference High 2020-08-26 – 25 Unauthorized access to private project security dashboard Analysed #853355 Valid Information Disclosure Medium 2020-11-21 – 24 Last build status and coverage leaked to unauthorized users Analysed #477222 Valid Information Disclosure Low 2019-09-01 – 24 Attacker can create malicious child epics linked to a victim's epic in an unrelated group Analysed #1892200 Valid Insecure Direct Object Reference Medium 2023-06-02 $1,160 22 Reporters can upload design to issues using the "Move to" feature Analysed #1112297 Valid Access Control Medium 2021-10-18 $600 21