CVE-2020-13320: 
GitLab vulnerability analysis and mitigation

An unauthorized access vulnerability was discovered in GitLab versions before 12.10.13, identified as CVE-2020-13320. The vulnerability allowed project members with Guest permissions to view the project security dashboard, even after their access level was reduced from a higher permission level (GitLab Security Release, CVE Details).

The vulnerability stemmed from an insecure authorization check in GitLab's security dashboard feature. When a user's permission was downgraded from maintainer to guest level, the system failed to properly revoke access to the security dashboard. This allowed users to continue viewing both new and existing security vulnerabilities through their security dashboard, even though their current permission level should not have granted this access (GitLab Issue).

The vulnerability exposed sensitive security information to unauthorized users. If exploited, it could allow former maintainers who were downgraded to guest access to view security vulnerabilities in private projects, potentially exposing critical security issues, newly added files, dependencies, and internal structure of the project/application (GitLab Issue).

The vulnerability could be exploited by first having maintainer access to a project and adding it to the security dashboard, then retaining access to the dashboard even after permissions were reduced to guest level. This allowed continuous monitoring of new security vulnerabilities in the project despite the reduced access level (GitLab Issue).

The vulnerability was patched in GitLab versions 13.1.2, 13.0.8, and 12.10.13. GitLab strongly recommended that all installations running affected versions be upgraded to the latest version immediately. The fix ensures that project access in the security dashboard is properly revoked when user permissions are downgraded (GitLab Security Release).

The vulnerability was responsibly reported by security researcher @vaib25vicky through GitLab's bug bounty program on HackerOne. GitLab acknowledged the security implications and addressed the issue in their security release (GitLab Security Release).