Project Milestones Disclosed Via Groups When the Victim disabled milestones access in project settings
HackerOne report #636560 by uzsunny
on 2019-07-05:
Reproduction steps:
Create a public group and public project.
Go to public project settings and disable the project settings to members only.
If the attacker visits milestones via projects then may see 404 not found page.
https://gitlab.com/victim-waka-waka/test-group-for-sharing/-/milestones/1
But the attacker will view the project mile stones via groups.
Impact
Attacker will view the project milestones which are disabled by the admin in project settings.
Attachments
Warning: Attachments received through HackerOne, please exercise caution!