Description
An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | GitLab CE/EE | Affects GitLab CE/EE 11.5 and later, Fixed in 12.1.2 in 12.0.4 and in 11.11.6 | — |