CVE-2020-7967: 
GitLab vulnerability analysis and mitigation

GitLab Enterprise Edition (EE) versions 8.0 through 12.7.2 contained an insecure permissions vulnerability. The issue was discovered and disclosed in January 2020, specifically affecting the visibility of activity counts for issues and merge requests, where non-members could view these counts despite project settings indicating otherwise (GitLab Release, CVE Mitre).

The vulnerability was related to permission control mechanisms in GitLab EE, where activity counts of issues and merge requests were exposed to non-members despite project settings configured to prevent such access. The issue was fixed in GitLab versions 12.7.4, 12.6.6, and 12.5.9 (GitLab Release).

The vulnerability allowed unauthorized users to view activity counts of issues and merge requests in projects where they should not have had access, potentially exposing sensitive project activity information (GitLab Release).

GitLab addressed this vulnerability by releasing patches in versions 12.7.4, 12.6.6, and 12.5.9. Organizations running affected versions were strongly recommended to upgrade to the latest version as soon as possible to mitigate the vulnerability (GitLab Release).

The vulnerability was responsibly reported by security researcher @ashish_r_padelkar, demonstrating the effectiveness of GitLab's security reporting program (GitLab Release).