CVE-2022-1352
Description
Due to an insecure direct object reference vulnerability in Gitlab EE/CE affecting all versions from 11.0 prior to 14.8.6, 14.9 prior to 14.9.4, and 14.10 prior to 14.10.1, an endpoint may reveal the issue title to a user who crafted an API call with the ID of the issue from a public project that restricts access to issue only to project members.
Summary dbcve.org
This is an Insecure Direct Object Reference (IDOR) vulnerability in GitLab where an endpoint fails to properly enforce authorization checks. A user can craft an API request using an issue ID from a public project where issue access is restricted to project members only, and the API will return the issue title to the unauthorized user, resulting in information disclosure.
Mitigation
Upgrade GitLab to versions 14.8.6, 14.9.4, 14.10.1 or later to receive the patched code that properly enforces authorization checks on the affected endpoint.