CVE-2020-13346
Description
Membership changes are not reflected in ToDo subscriptions in GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, allowing guest users to access confidential issues through API.
Summary dbcve.org
In GitLab versions prior to 13.2.10, 13.3.7, and 13.4.2, the ToDo subscription system does not properly synchronize with membership changes. When a user's project access is revoked or downgraded (e.g., from Developer to Guest), existing ToDo entries remain accessible via the API, allowing the now-revoked user to continue receiving notifications and accessing confidential issues they should no longer see.
Mitigation
Upgrade GitLab to version 13.2.10, 13.3.7, or 13.4.2 or later. Additionally, audit existing ToDo entries to ensure stale subscriptions for removed or downgraded users are revoked.