CVE-2019-13005: 
GitLab vulnerability analysis and mitigation

An issue was discovered in GitLab Enterprise Edition and Community Edition 11.10 through 12.0.2 where the GitLab GraphQL service was vulnerable to multiple authorization issues that disclosed restricted user, group, and repository metadata to unauthorized users. The vulnerability was assigned CVE-2019-13005 and was fixed in versions 12.0.3, 11.11.5, and 11.10.8 (GitLab Release, NVD).

The vulnerability was classified with a CVSS v3.1 Base Score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The CVSS v2.0 Base Score was 4.0 (MEDIUM) with the vector (AV:N/AC:L/Au:S/C:P/I:N/A:N). The vulnerability was categorized as an Incorrect Access Control issue (NVD).

The vulnerability allowed unauthorized users to access restricted user, group, and repository metadata through the GraphQL service. This information disclosure could potentially expose sensitive organizational data to unauthorized individuals (GitLab Release).

GitLab strongly recommended that all installations running affected versions be upgraded to version 12.0.3, 11.11.5, or 11.10.8 immediately. These versions contained the necessary security fixes to address the vulnerability (GitLab Release).

The vulnerability was responsibly reported by security researchers @rpadovani and @xanbanx, who were acknowledged in GitLab's security release announcement (GitLab Release).