CVE-2020-10079: 
GitLab vulnerability analysis and mitigation

GitLab versions 7.10 through 12.8.1 contained an Incorrect Access Control vulnerability (CVE-2020-10079) that was disclosed on March 4, 2020. The vulnerability affected both GitLab Community Edition (CE) and Enterprise Edition (EE), where under certain conditions users who should have been required to configure two-factor authentication were not being required to do so (GitLab Advisory).

The vulnerability is classified as a Missing Authentication for Critical Function (CWE-306). It received a CVSS v3.1 Base Score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating network accessibility, low attack complexity, no privileges required, and low impact on integrity (NVD).

The vulnerability allowed users to bypass two-factor authentication requirements in certain conditions, potentially compromising the security of accounts that should have had this additional security measure in place (GitLab Advisory).

The vulnerability was fixed in GitLab version 12.8.2. GitLab strongly recommended that all installations running affected versions be upgraded to the latest version as soon as possible (GitLab Advisory).