CVE-2020-8114: 
GitLab vulnerability analysis and mitigation

GitLab Enterprise Edition (EE) versions 8.9 and later through 12.7.2 contained a security vulnerability related to user permissions validation in the ProjectExportWorker functionality. The vulnerability was discovered and disclosed in January 2020, with CVE-2020-8114 being assigned to track this security issue (GitLab Security Release).

The vulnerability stemmed from a failure to validate user permissions in the ProjectExportWorker when users scheduled project exports. When a user scheduled an export but subsequently lost access to the project before the export process began, the system would still process the export request, bypassing the intended access controls (GitLab Issue).

This vulnerability could allow users who had lost access to projects to continue accessing project data through previously scheduled exports. More critically, blocked users could potentially trigger repeated exports, which could lead to system degradation and potentially cause full system outages (GitLab Issue).

The vulnerability could be exploited by users who previously had access to a project and had scheduled exports before their access was revoked. The exploitation process was relatively straightforward as it required no special tools or complex techniques, only requiring the ability to schedule an export before losing access (GitLab Security Release).

GitLab addressed this vulnerability in versions 12.7.4, 12.6.6, and 12.5.9. The recommended mitigation is to upgrade to these or later versions as soon as possible. GitLab strongly recommended that all installations running affected versions should be upgraded to the latest version (GitLab Security Release).