CVE-2021-39930: 
GitLab vulnerability analysis and mitigation

Missing authorization in GitLab EE versions between 12.4 and 14.3.6, between 14.4.0 and 14.4.4, and between 14.5.0 and 14.5.2 allowed an attacker to access a user's custom project and group templates (GitLab Security, CVE Mitre). The vulnerability was discovered and reported through GitLab's HackerOne bug bounty program by researcher @ngalog.

The vulnerability stems from a missing authorization check in the GitLab Enterprise Edition's template access functionality. The issue has a CVSS v3.1 score of 4.3 (Medium) severity (NVD Results). The vulnerability allowed unauthorized access to private group information through the 'availablegrouptemplates' endpoint (GitLab Issue).

The vulnerability allowed attackers to access unauthorized user's custom project and group templates, potentially exposing sensitive project and group information. This could lead to information disclosure of private group templates and associated project data (GitLab Security).

The vulnerability was patched in GitLab versions 14.5.2, 14.4.4, and 14.3.6. Users are strongly recommended to upgrade to these versions or later to mitigate the vulnerability. GitLab.com was already running the patched version at the time of disclosure (GitLab Security).