medium4.3
CVE-2020-26415
Information about the starred projects for private user profiles was exposed via the GraphQL API starting from 12.2 via the REST API.
Impact
Information about the starred projects for private user profiles was exposed via the GraphQL API starting from 12.2 via the REST API. This affects GitLab >=12.2 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gitlab | Gitlab | from 12.2.0 before 13.4.7 from 13.5.0 before 13.5.5 from 13.6.0 before 13.6.2 |