CVE-2020-26417

Vulnerability

An information disclosure vulnerability exists in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 13.1 through 13.4.7, 13.5 through 13.5.5, and 13.6 through 13.6.2. The GraphQL API does not properly redact groupMemberships, projectMemberships, and starredProjects for users who have set their profile to private, allowing unauthenticated or low-privileged users to query this data [1].

Exploitation

An attacker with network access to the GitLab instance can craft a GraphQL query targeting user profiles. No special authentication or elevated privileges are required; the attacker simply needs to know or enumerate user IDs or usernames. The vulnerability is triggered when the GraphQL endpoint returns membership data for profiles marked as private, which should have been redacted according to the user's privacy settings [1].

Impact

Successful exploitation results in unauthorized information disclosure. The attacker learns the private group and project memberships of GitLab users, potentially revealing sensitive organizational structures or non-public collaborations. This violates the confidentiality expectation of users who have selected the private profile option. The vulnerability does not grant write access or code execution on the system [1].

Mitigation

GitLab released patches in versions 13.4.7, 13.5.5, and 13.6.2 on 2020-12-11. All installations running affected versions should upgrade immediately to the corresponding patched release. No workaround is available for unpatched instances beyond restricting network access to the GraphQL endpoint [1].