CVE-2020-8795

Summary dbcve.org

In GitLab Enterprise Edition versions 12.5.0 through 12.7.5, a flaw in the group sharing mechanism allowed users to gain unauthorized access to projects. When sharing a group with another group, the access control logic failed to properly enforce permission boundaries, potentially exposing sensitive project data to users who should not have access.

Mitigation

Upgrade GitLab EE to version 12.7.6 or later to patch the authorization bypass. Review audit logs to check for any unauthorized access that may have occurred while the vulnerable version was in use.