CVE-2020-10978: 
GitLab vulnerability analysis and mitigation

GitLab EE/CE versions 8.11 to 12.9 contained an information disclosure vulnerability where issues opened in a public project and then moved to a private project would leak information through both the Web-UI and GraphQL API. The vulnerability was discovered and reported by @0xwintermute and was assigned CVE-2020-10978. The issue was publicly disclosed on March 26, 2020 (GitLab Release).

The vulnerability has been assigned a CVSS v3.1 score of 5.3 (Medium) and CVSS v2.0 score of 5.0 (Medium). The issue specifically involved information leakage when issues were transferred from public to private projects, potentially exposing private project namespace information through both the web interface and GraphQL API endpoints (NVD Results).

The vulnerability could lead to unauthorized disclosure of private project information, specifically the namespace of private projects, potentially compromising the confidentiality of private project data (GitLab Release).

GitLab strongly recommended that all installations running affected versions be upgraded to version 12.9.1 or later as soon as possible to address this vulnerability (GitLab Release).