CVE-2022-0390: 
GitLab vulnerability analysis and mitigation

Improper access control vulnerability (CVE-2022-0390) was discovered in GitLab CE/EE versions 12.7 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1. The vulnerability allowed project non-members to retrieve issue details when it was linked to an item from the vulnerability dashboard (GitLab Security, CVE Mitre).

The vulnerability was classified as a medium severity issue with a CVSS score of 4.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). The issue stemmed from an improper access control mechanism that failed to properly restrict access to linked issue details in the vulnerability dashboard (GitLab Security).

When exploited, the vulnerability allowed unauthorized users (project non-members) to access and retrieve issue details that they should not have had permission to view, particularly when these issues were linked to items in the vulnerability dashboard (GitLab Security).

The vulnerability was patched in GitLab versions 14.7.1, 14.6.4, and 14.5.4. Users were strongly recommended to upgrade their GitLab installations to one of these patched versions immediately. GitLab.com was already running the patched version at the time of disclosure (GitLab Security).