CVE-2021-39915: 
GitLab vulnerability analysis and mitigation

Improper access control in the GraphQL API in GitLab CE/EE affecting all versions starting from 13.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an attacker to see the names of project access tokens on arbitrary projects (GitLab Advisory).

The vulnerability exists in GitLab's GraphQL API implementation where unauthenticated users could query and retrieve project access token names. The issue has been assigned a CVSS v3.1 Base Score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (NVD).

The vulnerability allows unauthorized users to access project access token names, which could potentially reveal sensitive information about private projects, particularly affecting premium customers. When project access tokens are created, their names often contain informative details about the project or its purpose, which were not intended to be publicly visible (HackerOne Report).

The vulnerability has been fixed in GitLab versions 14.5.2, 14.4.4, and 14.3.6. Users are strongly recommended to upgrade to these versions or later to address this security issue. GitLab.com has already been updated with the patched version (GitLab Advisory).