CVE-2022-0152: 
GitLab vulnerability analysis and mitigation

An issue was discovered in GitLab affecting all versions starting from 13.10 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, and all versions starting from 14.6.0 before 14.6.2. GitLab was vulnerable to unauthorized access to some particular fields through the GraphQL API (GitLab Release, CVE Mitre).

The vulnerability was related to improper access control in GitLab's GraphQL API, where certain vulnerability-related fields (Pipeline#securityReportFindings and Pipeline#securityReportSummary) were accessible to unauthorized users. This was a medium severity issue with a CVSS score of 6.5 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) (GitLab Release).

The vulnerability allowed unauthorized users to access sensitive security-related information through the GraphQL API, potentially exposing vulnerability data and security report findings to unauthorized individuals (GitLab Release).

The vulnerability was patched in GitLab versions 14.4.5, 14.5.3, and 14.6.2. Users are strongly recommended to upgrade to these versions or later to mitigate the vulnerability. GitLab.com was already running the patched version at the time of disclosure (GitLab Release).