CVE-2020-26413: 
GitLab vulnerability analysis and mitigation

An information disclosure vulnerability was discovered in GitLab CE/EE (CVE-2020-26413) affecting all versions from 13.4 to versions before 13.6.2. The vulnerability allows unauthorized access to user email addresses through GraphQL queries, even when email privacy settings are enabled (NVD, Ubuntu).

The vulnerability exists in GitLab's GraphQL implementation where a query to the user endpoint could reveal email addresses that should have been private. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating that it can be exploited over the network with low attack complexity and requires no privileges or user interaction (NVD).

The vulnerability allows attackers to access private email addresses of GitLab users by simply knowing their usernames. This could lead to mass harvesting of email addresses from the platform, potentially exposing users to unwanted communications or targeted phishing attacks (GitLab Issue).

The vulnerability can be exploited by sending a specific GraphQL query to the GitLab instance. The query structure 'user(username:"<victim>"){ email username }' allows retrieval of email addresses for any user account on the platform (GitLab Issue).

The vulnerability was fixed in GitLab version 13.6.2. Users and administrators are advised to upgrade to this version or later to protect against this information disclosure vulnerability (NVD).