CVE-2020-26406

Name of the Vulnerable Software and Affected Versions GitLab EE versions 13.3 through 13.3.8 GitLab EE versions 13.4 through 13.4.4 GitLab EE versions 13.5 through 13.5.1

Description Certain SAST CiConfiguration information could be viewed by unauthorized users in GitLab EE. This information was exposed through GraphQL to non-members of public projects with repository visibility restricted as well as guest members on private projects.

Recommendations For versions 13.3 through 13.3.8, update to version 13.3.9 or later to resolve the issue. For versions 13.4 through 13.4.4, update to version 13.4.5 or later to resolve the issue. For versions 13.5 through 13.5.1, update to version 13.5.2 or later to resolve the issue.