CVE-2019-12825: 
GitLab vulnerability analysis and mitigation

CVE-2019-12825 affects GitLab Enterprise 12.0.0-pre, involving unauthorized access to Container Registry functionality. The vulnerability was discovered and disclosed in February 2020. The issue allows authenticated remote attackers to access Docker registries of other groups without proper authorization (NVD).

The vulnerability occurs when a user changes the path of a group in GitLab. Docker registries are not properly adapted to the new namespace and remain in the old namespace. This implementation flaw leaves the registries unprotected and accessible to all other users who previously had no access to the repository. The vulnerability has been assigned a CVSS v3.1 score of 4.3 (MEDIUM) and CVSS v2.0 score of 4.0 (MEDIUM) (NVD, Atomic111 Blog).

The vulnerability allows unauthorized users to access Docker registries belonging to other groups. When exploited, attackers can read and access container images from private repositories they should not have access to, potentially exposing sensitive information stored in these containers (Atomic111 Blog).

The vulnerability has been fixed in later versions of GitLab Enterprise. Organizations should upgrade to a patched version to prevent unauthorized access to container registries (NVD).