CVE-2021-39889

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 14.1 and later

Description: The issue is related to an insecure direct object reference vulnerability. An endpoint may reveal the protected branch name to a malicious user who makes a crafted API call with the ID of the protected branch.

Recommendations: For GitLab EE versions 14.1 and later, consider restricting access to the vulnerable endpoint until a patch is available. As a temporary workaround, avoid using the ID of the protected branch in crafted API calls to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.