Many endpoints use `project.{issues,merge_request}.{where,find}` without checking current user access to that feature (#23867) · Issues · GitLab.org / GitLab FOSS