SnippetFinder information disclosure
The GitLab SnippetFinder component contained an information disclosure
which allowed access to snippets restricted to Only team members or
configured as disabled. The issue is now resolved in the latest version.
LDAP API authorization issue
An LDAP API endpoint contained an authorization vulnerability which
unintentionally disclosed bulk LDAP groups data. This issue is now fixed in
the latest release.
Persistent XSS mermaid markdown
The mermaid markdown feature contained a persistent XSS issue that is now
resolved in the latest release.
Insecure direct object reference Todo API
The Todo API was vulnerable to an insecure direct object reference issue
which resulted in an information disclosure of confidential data.
GitHub import access control issue
An improper access control weakness issue was discovered in the GitHub
import feature. The issue allowed an attacker to create projects under other
accounts which they shouldn't have access to. The issue is now resolved in
the latest version.
Protected variables information disclosure
The CI jobs protected tag feature contained a vulnerability which
resulted in an information disclosure of protected variables. The issue is
now resolved in the latest release.