CVE-2020-10952: 
GitLab vulnerability analysis and mitigation

GitLab EE/CE versions 8.11 through 12.9.1 contained a security vulnerability that allowed blocked users to pull and push docker images. The vulnerability was discovered and reported by @logan5, and was officially assigned CVE-2020-10952. The issue was disclosed on March 26, 2020, and subsequently patched in GitLab's security release versions 12.9.1, 12.8.8, and 12.7.8 (GitLab Release, NVD).

The vulnerability allowed blocked users to maintain access to docker image operations within GitLab's internal container registry, specifically for projects they previously had access to. The severity of this vulnerability was assessed with a CVSS v3.1 score of 6.5 (Medium) and a CVSS v2.0 score of 5.8 (Medium) (NVD).

Under certain circumstances, blocked users could continue to pull images from and push images to the internal container registry of any projects they previously had access to, effectively bypassing access control restrictions (GitLab Release).

GitLab addressed this vulnerability by releasing patches in versions 12.9.1, 12.8.8, and 12.7.8. The company strongly recommended that all affected installations be upgraded to one of these versions immediately to mitigate the security risk (GitLab Release).