CVE-2022-2539: 
GitLab vulnerability analysis and mitigation

An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.6 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1, which allowed a project member to filter issues by contact and organization. This vulnerability was discovered internally by the GitLab team and was assigned CVE-2022-2539 (GitLab Security Release).

The vulnerability is classified as a medium severity issue with a CVSS score of 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). The issue relates to unauthorized access control where project members could filter issues by contact and organization when they should not have had this capability (GitLab Security Release).

The vulnerability allows unauthorized access to filtering functionality, potentially exposing sensitive information about contacts and organizations within GitLab projects. This could lead to information disclosure of data that should be restricted (GitLab Security Release).

The vulnerability has been fixed in GitLab versions 15.0.5, 15.1.4, and 15.2.1. Users are strongly recommended to upgrade to one of these patched versions immediately. GitLab.com was already running the patched version at the time of disclosure (GitLab Security Release).