Repository and organization project boards failed to verify if a viewer had the necessary permissions to read pull requests that referenced issues on the board. This allowed users, including anonymous visitors of public boards, to see the path of a private repository, as well as the number, title, and state of private pull requests. The pull request body, diff, and files remained protected.