CVE-2020-7969: 
GitLab vulnerability analysis and mitigation

GitLab Enterprise Edition (EE) versions 8.0 through 12.7.2 were found to contain an information disclosure vulnerability identified as CVE-2020-7969. The vulnerability was discovered and reported by @xanbanx, allowing unexpired Todos to be leveraged for disclosure of potentially confidential issues and merge requests (GitLab Release, CVE Details).

The vulnerability stems from a security flaw in GitLab's Todo functionality where unexpired Todos could be exploited to reveal confidential information about issues and merge requests that should otherwise be restricted. The issue was addressed in GitLab version 12.7.4 (GitLab Release).

The vulnerability could lead to unauthorized access to confidential issues and merge requests through the exploitation of unexpired Todos, potentially exposing sensitive project information (GitLab Release).

GitLab strongly recommends that all affected installations be upgraded to version 12.7.4 or later as soon as possible. This security release addresses the vulnerability and prevents unauthorized access to confidential information through the Todos feature (GitLab Release).